← LeaderboardThe Skill Leaderboard

analyzing-memory-forensics-with-lime-and-volatility

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

analyzing-memory-forensics-with-lime-and-volatility

Start a fresh conversation. Replace the highlighted placeholders.

Use analyzing-memory-forensics-with-lime-and-volatility to analyze the authorized Linux memory image at [memory image path] and report processes, bash history, network connections, loaded modules, and suspected injected code.

Required inputs

  • [memory image path]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: analyzing-memory-forensics-with-lime-and-volatilitydescription: 'Performs Linux memory acquisition using LiME (Linux Memory Extractor)  kernel module and analysis with Volatility 3 framework. Extracts process lists,  network connections, bash history, loaded kernel modules, and injected code from  Linux memory images. Use when performing incident response on compromised Linux  systems.  'domain: cybersecuritysubdomain: security-operationstags: - memory-forensics- linux-forensics- lime- volatility- incident-response- kernel-modulesversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - DE.CM-01- RS.MA-01- GV.OV-01- DE.AE-02mitre_attack: - T1055- T1003.001- T1620- T1564.001

Analyzing Memory Forensics with LiME and Volatility

When to Use

  • When investigating security incidents that require analyzing memory forensics with lime and volatility
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Acquire Linux memory using LiME kernel module, then analyze with Volatility 3 to extract forensic artifacts from the memory image.

# LiME acquisition
insmod lime-$(uname -r).ko "path=/evidence/memory.lime format=lime"

# Volatility 3 analysis
vol3 -f /evidence/memory.lime linux.pslist
vol3 -f /evidence/memory.lime linux.bash
vol3 -f /evidence/memory.lime linux.sockstat

import volatility3
from volatility3.framework import contexts, automagic
from volatility3.plugins.linux import pslist, bash, sockstat

# Programmatic Volatility 3 usage
context = contexts.Context()
automagics = automagic.available(context)

Key analysis steps:

  1. Acquire memory with LiME (format=lime or format=raw)
  2. List processes with linux.pslist, compare with linux.psscan
  3. Extract bash command history with linux.bash
  4. List network connections with linux.sockstat
  5. Check loaded kernel modules with linux.lsmod for rootkits

Examples

# Full forensic workflow
vol3 -f memory.lime linux.pslist | grep -v "\[kthread\]"
vol3 -f memory.lime linux.bash
vol3 -f memory.lime linux.malfind
vol3 -f memory.lime linux.lsmod
analyzing-memory-forensics-with-lime-and-volatility by mukul975 · The Skill Leaderboard