Memory Forensics Playbook

What it does

Provides a comprehensive memory forensics playbook: acquisition steps for live systems and VMs, Volatility 3 usage and essential plugins (process, network, DLL analysis), detection patterns (injection, rootkits), YARA integration, and analysis workflows for malware and incident response. Includes best practices for acquisition, integrity verification, and documentation.

When to use it

Use when performing memory acquisition or analysis during incident response, malware analysis, or forensic investigations. Suitable for analysts needing concrete commands, Volatility plugin examples, and stepwise workflows from acquisition to reporting. Not for unrelated tasks.

What's included

• Scripts: None bundled (has_scripts=false)
• References: Points to implementation-playbook and symbol resources mentioned in the skill body (has_references=false in repo bundle)
• Instructions: Detailed acquisition commands across platforms, Volatility 3 usage examples, analysis workflows (malware and IR), detection rules, YARA examples, and best practices for chain-of-custody and validation.

Compatible agents

Agents that can run or orchestrate forensic tooling and present command outputs (e.g., Copilot-style agents, Claude Code, or custom forensic automation integrations).