vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reverse-skills-max: initial public release (restored, redacted, hardened)

Browse Source
This commit is contained in:
baradok609hecl1pq6qi
2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

201
vendor-new/Anthropic-Cybersecurity-Skills/skills/performing-memory-forensics-with-volatility3/LICENSE Normal file
View File

@@ -0,0 +1,201 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to the Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by the Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding any notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. Please do not remove or change
the license header comment from a contributed file except when
necessary.
Copyright 2026 mukul975
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

49
vendor-new/Anthropic-Cybersecurity-Skills/skills/performing-memory-forensics-with-volatility3/SKILL.es.md Normal file
View File

@@ -0,0 +1,49 @@
---
name: performing-memory-forensics-with-volatility3
description: Analyze memory dumps to extract processes, network connections, and malware artifacts using Volatility3.
domain: cybersecurity
subdomain: digital-forensics
tags: [forensics, memory-analysis, volatility3, incident-response]
version: "1.0"
author: mahipal
license: Apache-2.0
language: es
---
# Análisis Forense de Memoria con Volatility3
## Descripción General
Volatility3 es el framework líder de código abierto para análisis forense de memoria. Permite extraer procesos en ejecución, conexiones de red, módulos cargados, artefactos de malware, credenciales en memoria, y evidencia de actividad maliciosa desde volcados de memoria RAM de sistemas Windows, Linux y macOS.
## Prerrequisitos
- Python 3.8+ con Volatility3 instalado (`pip install volatility3`)
- Volcado de memoria adquirido (formatos: raw, EWF, LiME, VMware .vmem)
- Tablas de símbolos apropiadas para el SO analizado
- Espacio en disco suficiente (2-3x el tamaño del volcado de memoria)
## Conceptos Clave
| Concepto | Descripción |
|----------|-------------|
| **Plugin PsList** | Lista procesos activos con PID, PPID, tiempo de creación |
| **Plugin NetScan** | Extrae conexiones de red y puertos en escucha |
| **Plugin MalFind** | Detecta inyección de código en procesos (secciones PAGE_EXECUTE_READWRITE) |
| **Plugin DllList** | Lista DLLs cargadas por cada proceso |
| **Plugin Handles** | Muestra handles abiertos (archivos, registros, mutex) |
| **Plugin CmdLine** | Extrae líneas de comando de procesos |
## Pasos
1. Identificar el perfil del SO del volcado de memoria
2. Ejecutar `vol -f memory.dmp windows.pslist` para listar procesos
3. Analizar procesos sospechosos con `windows.pstree` para ver jerarquía
4. Buscar conexiones de red con `windows.netscan`
5. Detectar inyección de código con `windows.malfind`
6. Extraer artefactos específicos (DLLs, handles, líneas de comando)
7. Correlacionar hallazgos para construir timeline del ataque
## Resultado Esperado
Reporte detallado de hallazgos forenses incluyendo procesos maliciosos identificados, conexiones C2, artefactos de malware extraídos, y timeline de actividad del atacante en el sistema comprometido.

305
vendor-new/Anthropic-Cybersecurity-Skills/skills/performing-memory-forensics-with-volatility3/SKILL.md Normal file
View File

@@ -0,0 +1,305 @@
---
name: performing-memory-forensics-with-volatility3
description: Analyze volatile memory (RAM) dumps using the Volatility 3 framework
to extract running processes, network connections, loaded modules, credentials,
and encryption keys, and to detect process hollowing, DLL injection, or hidden
processes/rootkits. Use during incident response on a compromised or suspect system
when disk-based forensics alone is insufficient and volatile evidence of malware
or intrusion must be recovered from memory.
domain: cybersecurity
subdomain: digital-forensics
tags:
- forensics
- memory-forensics
- volatility
- ram-analysis
- malware-detection
- incident-response
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-03
- DE.AE-02
- RS.MA-01
mitre_attack:
- T1005
- T1074
- T1119
- T1070
- T1059
---
# Performing Memory Forensics with Volatility 3
## When to Use
- When analyzing a RAM dump from a compromised or suspect system
- During incident response to identify running malware, injected code, or rootkits
- When you need to extract credentials, encryption keys, or network connections from memory
- For detecting process hollowing, DLL injection, or hidden processes
- When disk-based forensics alone is insufficient and volatile data is critical
## Prerequisites
- Python 3.7+ installed
- Volatility 3 framework installed (`pip install volatility3`)
- Memory dump in raw, ELF, or crash dump format
- Appropriate symbol tables (ISF files) for the target OS version
- Sufficient disk space for analysis output (2-3x memory dump size)
- Optional: YARA rules for malware scanning in memory
## Workflow
### Step 1: Acquire Memory Dump and Install Volatility 3
```bash
# Install Volatility 3
pip install volatility3
# Or install from source for latest features
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .
# Download Windows symbol tables (ISF packs)
# Place in volatility3/symbols/ directory
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
unzip windows.zip -d /opt/volatility3/volatility3/symbols/
# Download Linux and Mac symbol packs
wget https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
wget https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip
# Memory acquisition tools (for live systems):
# Windows: winpmem, DumpIt, FTK Imager
# Linux: LiME (Linux Memory Extractor)
sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"
# Verify the memory dump
file /cases/case-2024-001/memory/memory.raw
ls -lh /cases/case-2024-001/memory/memory.raw
```
### Step 2: Identify the Operating System Profile
```bash
# Run banners plugin to identify the OS
vol -f /cases/case-2024-001/memory/memory.raw banners
# For Windows, identify the OS version
vol -f /cases/case-2024-001/memory/memory.raw windows.info
# Output example:
# Variable Value
# Kernel Base 0xf8047e200000
# DTB 0x1ad000
# Symbols ntkrnlmp.pdb/GUID
# Is64Bit True
# IsPAE False
# primary layer Intel32e
# KdVersionBlock 0xf8047ee232c0
# Major/Minor 15.19041
# Machine Type 34404
# KeNumberProcessors 4
# SystemTime 2024-01-18 14:32:15 UTC
# NtBuildLab 19041.1.amd64fre.vb_release.191206-1406
# NtProductType NtProductWinNt
# NtSystemRoot C:\WINDOWS
# PE MajorOperatingSystemVersion 10
# PE MinorOperatingSystemVersion 0
# For Linux memory dumps
vol -f /cases/case-2024-001/memory/linux_mem.lime linux.info
```
### Step 3: Enumerate Processes and Detect Anomalies
```bash
# List all running processes
vol -f /cases/case-2024-001/memory/memory.raw windows.pslist | tee /cases/case-2024-001/analysis/pslist.txt
# Show process tree (parent-child relationships)
vol -f /cases/case-2024-001/memory/memory.raw windows.pstree | tee /cases/case-2024-001/analysis/pstree.txt
# Detect hidden processes using cross-view analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.psscan | tee /cases/case-2024-001/analysis/psscan.txt
# Compare pslist vs psscan to find hidden processes
diff <(vol -f memory.raw windows.pslist | awk '{print $1}' | sort) \
<(vol -f memory.raw windows.psscan | awk '{print $1}' | sort)
# List DLLs loaded by a suspicious process (PID 4532)
vol -f /cases/case-2024-001/memory/memory.raw windows.dlllist --pid 4532
# Check for process hollowing and injection
vol -f /cases/case-2024-001/memory/memory.raw windows.malfind | tee /cases/case-2024-001/analysis/malfind.txt
# Dump suspicious process memory for further analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.memmap --pid 4532 --dump \
-o /cases/case-2024-001/analysis/dumps/
```
### Step 4: Analyze Network Connections and Registry
```bash
# List active network connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | tee /cases/case-2024-001/analysis/netscan.txt
# Filter for established connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep ESTABLISHED
# Filter for listening ports
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep LISTENING
# Extract network connections with process mapping
vol -f /cases/case-2024-001/memory/memory.raw windows.netstat | tee /cases/case-2024-001/analysis/netstat.txt
# Dump registry hives from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.registry.hivelist
# Extract specific registry keys
vol -f /cases/case-2024-001/memory/memory.raw windows.registry.printkey \
--key "Software\Microsoft\Windows\CurrentVersion\Run"
# Check services
vol -f /cases/case-2024-001/memory/memory.raw windows.svcscan | tee /cases/case-2024-001/analysis/services.txt
```
### Step 5: Extract Credentials and Sensitive Data
```bash
# Dump cached credentials (hashdump)
vol -f /cases/case-2024-001/memory/memory.raw windows.hashdump | tee /cases/case-2024-001/analysis/hashes.txt
# Extract LSA secrets
vol -f /cases/case-2024-001/memory/memory.raw windows.lsadump
# Dump cached domain credentials
vol -f /cases/case-2024-001/memory/memory.raw windows.cachedump
# Search for plaintext strings in process memory
vol -f /cases/case-2024-001/memory/memory.raw windows.strings --pid 4532 \
| grep -iE '(password|credential|token|api.key)'
# Extract command history from cmd.exe/powershell
vol -f /cases/case-2024-001/memory/memory.raw windows.cmdline | tee /cases/case-2024-001/analysis/cmdline.txt
# Extract environment variables
vol -f /cases/case-2024-001/memory/memory.raw windows.envars --pid 4532
```
### Step 6: Scan for Malware with YARA Rules
```bash
# Scan memory with YARA rules
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
--yara-file /opt/yara-rules/malware_index.yar | tee /cases/case-2024-001/analysis/yara_hits.txt
# Scan specific process memory
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
--yara-file /opt/yara-rules/apt_rules.yar --pid 4532
# Check loaded kernel modules for rootkits
vol -f /cases/case-2024-001/memory/memory.raw windows.modules | tee /cases/case-2024-001/analysis/modules.txt
# Detect unlinked/hidden modules
vol -f /cases/case-2024-001/memory/memory.raw windows.modscan | tee /cases/case-2024-001/analysis/modscan.txt
# Check for SSDT hooks (System Service Descriptor Table)
vol -f /cases/case-2024-001/memory/memory.raw windows.ssdt | grep -v "ntoskrnl\|win32k"
# Dump a suspicious executable from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.dumpfiles --pid 4532 \
-o /cases/case-2024-001/analysis/extracted/
```
### Step 7: Compile Findings into a Report
```bash
# Generate comprehensive analysis summary
echo "=== MEMORY FORENSICS REPORT ===" > /cases/case-2024-001/analysis/memory_report.txt
echo "Image: memory.raw" >> /cases/case-2024-001/analysis/memory_report.txt
echo "OS: Windows 10 Build 19041" >> /cases/case-2024-001/analysis/memory_report.txt
echo "" >> /cases/case-2024-001/analysis/memory_report.txt
echo "--- Suspicious Processes ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/malfind.txt >> /cases/case-2024-001/analysis/memory_report.txt
echo "--- Network Connections ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/netscan.txt >> /cases/case-2024-001/analysis/memory_report.txt
echo "--- YARA Matches ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/yara_hits.txt >> /cases/case-2024-001/analysis/memory_report.txt
# Calculate hash of the memory dump for integrity
sha256sum /cases/case-2024-001/memory/memory.raw >> /cases/case-2024-001/analysis/memory_report.txt
```
## Key Concepts
| Concept | Description |
|---------|-------------|
| Volatile data | Information that exists only in RAM and is lost when power is removed |
| Process hollowing | Technique where malware replaces legitimate process memory with malicious code |
| DLL injection | Loading unauthorized DLLs into a running process address space |
| EPROCESS | Windows kernel structure representing a process; basis for process listing |
| Pool scanning | Searching memory for kernel object signatures to find hidden artifacts |
| VAD (Virtual Address Descriptor) | Memory management structure tracking process virtual memory regions |
| ISF (Intermediate Symbol Format) | Volatility 3 symbol table format for OS-specific structure definitions |
| Malfind | Plugin detecting injected code by examining VAD permissions and content |
## Tools & Systems
| Tool | Purpose |
|------|---------|
| Volatility 3 | Primary open-source memory forensics framework |
| LiME | Linux Memory Extractor for acquiring Linux RAM dumps |
| WinPmem | Windows physical memory acquisition driver |
| DumpIt | Comae one-click Windows memory dump utility |
| YARA | Pattern matching engine for malware signature scanning |
| Rekall | Alternative memory forensics framework (Google) |
| MemProcFS | Memory process file system for memory analysis |
| strings | Extract printable strings from binary memory dumps |
## Common Scenarios
**Scenario 1: Active Malware Investigation**
Acquire memory with DumpIt, run pslist/pstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.
**Scenario 2: Credential Theft After Breach**
Run hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.
**Scenario 3: Rootkit Detection**
Compare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.
**Scenario 4: Ransomware Incident Recovery**
Extract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.
## Output Format
```
Memory Forensics Analysis:
Image: memory.raw (16 GB)
OS Identified: Windows 10 x64 Build 19041
Capture Time: 2024-01-18 14:32:15 UTC
Process Analysis:
Total Processes: 87
Hidden Processes: 2 (PIDs: 4532, 6128)
Injected Processes: 3 (malfind detections)
Suspicious: svchost.exe (PID 4532) - injected code at 0x7FFE0000
Network Connections:
Total: 45
Established: 12
Suspicious: 3 (C2 connections to 185.xx.xx.xx:443)
Credentials Found:
NTLM Hashes: 4 accounts
Cached Creds: 2 domain accounts
YARA Matches:
CobaltStrike_Beacon: PID 4532 (3 hits)
Mimikatz_Memory: PID 6128 (1 hit)
Extracted Artifacts: 15 files dumped to /analysis/extracted/
```

47
vendor-new/Anthropic-Cybersecurity-Skills/skills/performing-memory-forensics-with-volatility3/references/api-reference.md Normal file
View File

@@ -0,0 +1,47 @@
# API Reference: Memory Forensics with Volatility 3
## Volatility 3 CLI
| Plugin | Description |
|--------|-------------|
| `windows.info` | OS version, kernel base, system time |
| `windows.pslist` | List processes via EPROCESS linked list |
| `windows.pstree` | Process tree with parent-child relationships |
| `windows.psscan` | Pool scan for processes (finds hidden) |
| `windows.malfind` | Detect injected code in process memory |
| `windows.netscan` | Active network connections and listening ports |
| `windows.cmdline` | Command line arguments for all processes |
| `windows.dlllist` | DLLs loaded per process |
| `windows.hashdump` | Extract cached NTLM password hashes |
| `windows.lsadump` | LSA secrets from memory |
| `windows.svcscan` | Windows services enumeration |
| `windows.modules` | Loaded kernel modules |
| `windows.modscan` | Pool scan for kernel modules (finds hidden) |
| `windows.registry.hivelist` | List registry hives in memory |
| `windows.registry.printkey` | Print specific registry key values |
| `yarascan` | Scan memory with YARA rules |
| `windows.memmap` | Dump process memory to disk |
## Common Flags
| Flag | Description |
|------|-------------|
| `-f <file>` | Memory dump file path |
| `--pid <pid>` | Filter by process ID |
| `--dump` | Dump matched content to files |
| `-o <dir>` | Output directory for dumps |
| `--yara-file <file>` | YARA rules file for scanning |
## Python Libraries
| Library | Version | Purpose |
|---------|---------|---------|
| `subprocess` | stdlib | Execute Volatility 3 CLI commands |
| `re` | stdlib | Parse plugin output |
## References
- Volatility 3: https://github.com/volatilityfoundation/volatility3
- Symbol tables: https://downloads.volatilityfoundation.org/volatility3/symbols/
- LiME: https://github.com/504ensicsLabs/LiME
- MemProcFS: https://github.com/ufrisk/MemProcFS

160
vendor-new/Anthropic-Cybersecurity-Skills/skills/performing-memory-forensics-with-volatility3/scripts/agent.py Normal file
View File

@@ -0,0 +1,160 @@
#!/usr/bin/env python3
"""Agent for performing memory forensics with Volatility 3.
Automates memory dump analysis including process enumeration,
network connection extraction, malware detection, and credential
extraction using Volatility 3 framework via subprocess.
"""
import subprocess
import json
import sys
import re
from pathlib import Path
class MemoryForensicsAgent:
"""Automates Volatility 3 memory forensics analysis."""
def __init__(self, memory_dump, output_dir):
self.memory_dump = memory_dump
self.output_dir = Path(output_dir)
self.output_dir.mkdir(parents=True, exist_ok=True)
def _run_vol(self, plugin, extra_args=None):
"""Execute a Volatility 3 plugin and return output."""
cmd = ["vol", "-f", self.memory_dump, plugin]
if extra_args:
cmd.extend(extra_args)
result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
return {"output": result.stdout, "stderr": result.stderr, "rc": result.returncode}
def get_os_info(self):
"""Identify the operating system from the memory dump."""
result = self._run_vol("windows.info")
if result["rc"] != 0:
result = self._run_vol("linux.info")
return result
def list_processes(self):
"""List all running processes."""
return self._run_vol("windows.pslist")
def get_process_tree(self):
"""Show process tree with parent-child relationships."""
return self._run_vol("windows.pstree")
def scan_hidden_processes(self):
"""Scan for hidden/unlinked processes via pool scanning."""
return self._run_vol("windows.psscan")
def detect_injected_code(self):
"""Detect process injection via malfind plugin."""
return self._run_vol("windows.malfind")
def get_network_connections(self):
"""Extract active network connections."""
return self._run_vol("windows.netscan")
def get_command_lines(self):
"""Extract command lines for all processes."""
return self._run_vol("windows.cmdline")
def dump_process_memory(self, pid):
"""Dump memory of a specific process."""
dump_dir = self.output_dir / "process_dumps"
dump_dir.mkdir(exist_ok=True)
return self._run_vol("windows.memmap", [
"--pid", str(pid), "--dump", "-o", str(dump_dir)
])
def extract_hashes(self):
"""Extract cached password hashes."""
return self._run_vol("windows.hashdump")
def scan_with_yara(self, yara_file):
"""Scan memory with YARA rules."""
return self._run_vol("yarascan", ["--yara-file", yara_file])
def get_registry_keys(self, key_path):
"""Extract specific registry keys from memory."""
return self._run_vol("windows.registry.printkey", ["--key", key_path])
def list_services(self):
"""List Windows services from memory."""
return self._run_vol("windows.svcscan")
def list_loaded_modules(self):
"""List loaded kernel modules."""
return self._run_vol("windows.modules")
def scan_hidden_modules(self):
"""Scan for hidden kernel modules."""
return self._run_vol("windows.modscan")
def get_dll_list(self, pid=None):
"""List DLLs loaded by processes."""
args = ["--pid", str(pid)] if pid else []
return self._run_vol("windows.dlllist", args if args else None)
def detect_anomalies(self):
"""Compare pslist vs psscan to find hidden processes."""
pslist = self._run_vol("windows.pslist")
psscan = self._run_vol("windows.psscan")
pslist_pids = set(re.findall(r"^\s*(\d+)\s", pslist["output"], re.MULTILINE))
psscan_pids = set(re.findall(r"^\s*(\d+)\s", psscan["output"], re.MULTILINE))
hidden = psscan_pids - pslist_pids
return {
"pslist_count": len(pslist_pids),
"psscan_count": len(psscan_pids),
"hidden_pids": sorted(hidden),
"hidden_count": len(hidden),
}
def generate_report(self, yara_file=None):
"""Run comprehensive memory analysis and generate report."""
report = {
"memory_dump": self.memory_dump,
"os_info": self.get_os_info()["output"][:500],
}
report["process_list"] = self.list_processes()["output"]
report["process_tree"] = self.get_process_tree()["output"]
report["malfind"] = self.detect_injected_code()["output"]
report["network"] = self.get_network_connections()["output"]
report["cmdline"] = self.get_command_lines()["output"]
report["hashes"] = self.extract_hashes()["output"]
report["services"] = self.list_services()["output"][:2000]
report["hidden_processes"] = self.detect_anomalies()
if yara_file:
report["yara_hits"] = self.scan_with_yara(yara_file)["output"]
report_path = self.output_dir / "memory_forensics_report.json"
with open(report_path, "w") as f:
json.dump(report, f, indent=2)
print(f"Memory Forensics Report: {report_path}")
print(f"Hidden processes: {report['hidden_processes']['hidden_count']}")
if report["malfind"]["output"].strip():
print("Malfind detections found - check report for details")
return report
def main():
if len(sys.argv) < 3:
print("Usage: agent.py <memory_dump> <output_dir> [yara_rules]")
sys.exit(1)
memory_dump = sys.argv[1]
output_dir = sys.argv[2]
yara_file = sys.argv[3] if len(sys.argv) > 3 else None
agent = MemoryForensicsAgent(memory_dump, output_dir)
agent.generate_report(yara_file)
if __name__ == "__main__":
main()