Skill34.9k repo starsupdated 1mo ago

analyzing-memory-forensics-with-lime-and-volatility

This Claude Code skill provides a structured procedure for acquiring Linux system memory using the LiME kernel module and analyzing the resulting memory image with Volatility 3 to extract forensic artifacts. Use this skill when investigating security incidents requiring memory forensics, building threat hunting procedures, training SOC analysts on memory analysis techniques, or validating detection coverage for memory-based attack indicators like hidden processes, rootkits, and command history.

View source Repository: Anthropic-Cybersecurity-Skills

Install in Claude Code

Copy

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/analyzing-memory-forensics-with-lime-and-volatility && cp -r /tmp/analyzing-memory-forensics-with-lime-and-volatility/skills/analyzing-memory-forensics-with-lime-and-volatility ~/.claude/skills/analyzing-memory-forensics-with-lime-and-volatility

Then start a new Claude Code session; the skill loads automatically.

Definition

SKILL.md

# Analyzing Memory Forensics with LiME and Volatility


## When to Use

- When investigating security incidents that require analyzing memory forensics with lime and volatility
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Instructions

Acquire Linux memory using LiME kernel module, then analyze with Volatility 3
to extract forensic artifacts from the memory image.

```bash
# LiME acquisition
insmod lime-$(uname -r).ko "path=/evidence/memory.lime format=lime"

# Volatility 3 analysis
vol3 -f /evidence/memory.lime linux.pslist
vol3 -f /evidence/memory.lime linux.bash
vol3 -f /evidence/memory.lime linux.sockstat
```

```python
import volatility3
from volatility3.framework import contexts, automagic
from volatility3.plugins.linux import pslist, bash, sockstat

# Programmatic Volatility 3 usage
context = contexts.Context()
automagics = automagic.available(context)
```

Key analysis steps:
1. Acquire memory with LiME (format=lime or format=raw)
2. List processes with linux.pslist, compare with linux.psscan
3. Extract bash command history with linux.bash
4. List network connections with linux.sockstat
5. Check loaded kernel modules with linux.lsmod for rootkits

## Examples

```bash
# Full forensic workflow
vol3 -f memory.lime linux.pslist | grep -v "\[kthread\]"
vol3 -f memory.lime linux.bash
vol3 -f memory.lime linux.malfind
vol3 -f memory.lime linux.lsmod
```