Community研究＆データ分析github.com

wshobson/memory-forensics

Volatilityなどのツールを用いたメモリ取得、プロセス解析、アーティファクト抽出など、メモリフォレンジック技術を習得します。メモリダンプの分析、インシデント調査、RAMキャプチャからのマルウェア解析に使用します。

memory-forensics とは？

このスキルは、メモリフォレンジックのエキスパートになるための包括的なガイドです。主にVolatilityや関連ツールを使用し、メモリ取得、プロセス解析、アーティファクト抽出といった重要な技術を習得できます。インシデント対応やマルウェア解析の現場で、RAMキャプチャから証拠を抽出し分析する際に役立ちます。対応プラットフォームはVolatilityが動作する環境（Windows、Linux、macOS）で、メモリダンプファイルを入力として、プロセスリスト、ネットワーク接続、レジストリ情報、ファイルオブジェクトなどのフォレンジックデータを出力します。スキルはCLIコマンドの例や解析手順をステップバイステップで提供し、初心者から上級者まで実践的なスキルを習得できます。

対応~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/wshobson/agents/tree/main/skills/memory-forensics

Installed? Explore more 研究＆データ分析 skills: affaan-m/uspto-database, affaan-m/scholar-evaluation, affaan-m/literature-review · View all 6 →

オリジナルを見る→すべてのスキルを見る

お気に入りのAIに質問する

このエージェントスキルを事前に読み込んだ状態で新しいチャットを開きます。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

ドキュメント

memory-forensics は何をしますか？

Volatilityなどのツールを用いたメモリ取得、プロセス解析、アーティファクト抽出など、メモリフォレンジック技術を習得します。メモリダンプの分析、インシデント調査、RAMキャプチャからのマルウェア解析に使用します。

概要

メモリフォレンジックは、揮発性メモリ（RAM）のスナップショットを分析し、実行中のプロセス、ネットワーク接続、暗号化されたデータ、マルウェアの痕跡などを特定する技術です。このスキルでは、Volatility 3 を中心に、以下のようなツールとテクニックをカバーします。

  • メモリ取得（FTK Imager, LiME, winpmem など）
  • プロセス解析（windows.psscan, linux.psaux など）
  • ネットワーク接続の調査（windows.netscan, linux.netstat など）
  • レジストリハイブの抽出と解析
  • ファイルオブジェクトと隠しプロセスの検出
  • マルウェアのペイロード抽出

前提条件

  • Volatility 3 がインストール済みであること（pip install volatility3）
  • 解析対象のメモリダンプファイル（例: memory.dmp, memdump.raw）
  • ターゲットOSのプロファイル情報（Volatility 2の場合）

使用方法

基本コマンド

# Volatility 3でプロファイルを自動検出
vol -f memory.dmp windows.psscan

# プロセスリストの表示
vol -f memory.dmp windows.pslist

# ネットワーク接続の表示
vol -f memory.dmp windows.netscan

高度な解析

# 隠しプロセスの検出（クロスビュー）
vol -f memory.dmp windows.psscan
vol -f memory.dmp windows.psxview

# DLLのリスト
vol -f memory.dmp windows.dlllist

# レジストリハイブのダンプ
vol -f memory.dmp windows.registry.hivelist
vol -f memory.dmp windows.registry.printkey

# ファイルオブジェクトの抽出
vol -f memory.dmp windows.filescan

実践的なシナリオ例

  1. マルウェア感染の調査

    # 不審なプロセスを特定
vol -f infected.dmp windows.psscan | grep -i suspicious
# プロセスのメモリをダンプ
vol -f infected.dmp windows.memdump --pid 1234 -o /output

  2. ネットワーク通信の追跡

    vol -f infected.dmp windows.netscan
# 外部接続先IPを確認

  3. ファイルの復元

    vol -f infected.dmp windows.filescan | grep ".exe$"
vol -f infected.dmp windows.dumpfiles --physaddr 0x...

注意点

  • メモリ取得時は、ホストシステムの整合性を保つため、フォレンジック的に適切な手順に従ってください。
  • 解析結果の解釈には、対象OSの知識が必要です。
  • Volatility 2と3ではコマンド構文が異なります。このドキュメントはVolatility 3（vol コマンド）を基準にしています。

参考リンク

ライセンス

このスキルは、元のリポジトリのライセンスに従います。

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

wshobson/accessibility-compliance

Implement WCAG 2.2 compliant interfaces with mobile accessibility, inclusive design patterns, and assistive technology support. Use when auditing accessibility, implementing ARIA patterns, building for screen readers, or ensuring inclusive user experiences.

wshobson/airflow-dag-patterns

Build production Apache Airflow DAGs with best practices for operators, sensors, testing, and deployment. Use when creating data pipelines, orchestrating workflows, or scheduling batch jobs.

wshobson/angular-migration

Migrate from AngularJS to Angular using hybrid mode, incremental component rewriting, and dependency injection updates. Use when upgrading AngularJS applications, planning framework migrations, or modernizing legacy Angular code.

wshobson/anti-reversing-techniques

Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.

wshobson/api-design-principles

Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.

wshobson/architecture-decision-records

Write and maintain Architecture Decision Records (ADRs) following best practices for technical decision documentation. Use when documenting significant technical decisions, reviewing past architectural choices, or establishing decision processes.

wshobson/architecture-patterns

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use this skill when designing clean architecture for a new microservice, when refactoring a monolith to use bounded contexts, when implementing hexagonal or onion architecture patterns, or when debugging dependency cycles between application layers.

wshobson/async-python-patterns

Master Python asyncio, concurrent programming, and async/await patterns for high-performance applications. Use when building async APIs, concurrent systems, or I/O-bound applications requiring non-blocking operations.

wshobson/attack-tree-construction

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

wshobson/auth-implementation-patterns

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

wshobson/avoid-ai-writing

Audit and rewrite prose so it stops reading as machine-generated. Use this skill when asked to remove AI-isms, clean up AI writing, edit a draft for AI tells, audit a README, changelog, release note, PR description, or blog post for machine-sounding prose, or make text sound less like AI. Supports a detect-only mode, a rewrite mode, and an edit-in-place mode, with optional voice and context profiles.

wshobson/backtesting-frameworks

Build robust backtesting systems for trading strategies with proper handling of look-ahead bias, survivorship bias, and transaction costs. Use when developing trading algorithms, validating strategies, or building backtesting infrastructure.

wshobson/bash-defensive-patterns

Master defensive Bash programming techniques for production-grade scripts. Use when writing robust shell scripts, CI/CD pipelines, or system utilities requiring fault tolerance and safety.

wshobson/bats-testing-patterns

Master Bash Automated Testing System (Bats) for comprehensive shell script testing. Use when writing tests for shell scripts, CI/CD pipelines, or requiring test-driven development of shell utilities.

wshobson/bazel-build-optimization

Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.

wshobson/before-you-build

Pre-build product and feature risk review for founders, product managers, and AI-assisted builders. Use this skill when the user is about to build a landing page, MVP, SaaS product, internal tool, agent workflow, or major feature and needs to check demand, positioning, monetization, retention, trust, distribution, and adoption risk before implementation starts.

wshobson/billing-automation

Build automated billing systems for recurring payments, invoicing, subscription lifecycle, and dunning management. Use when implementing subscription billing, automating invoicing, or managing recurring payment systems.

wshobson/binary-analysis-patterns

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.

wshobson/block-no-verify-hook

Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.

wshobson/brand-landingpage

Brand-first landing page designer — runs a brand-identity interview (colors, typography, shape language), then generates and iterates on a polished landing page via Stitch with deployment-ready HTML. Use when the user asks to create, design, or build a landing page, homepage, or marketing page and has no established visual direction. Skip when they have a design mockup, need a dashboard or app UI, are working at component level, building a multi-page app, or restyling with known design tokens — use frontend-design instead.

関連スキル

affaan-m/uspto-database

USPTO patent and trademark data workflow for official record lookup, PatentSearch queries, TSDR checks, assignment data, and reproducible IP research logs.

community

affaan-m/scholar-evaluation

Structured scholarly-work evaluation for papers, proposals, literature reviews, methods sections, evidence quality, citation support, and research-writing feedback.

community

affaan-m/literature-review

Systematic literature-review workflow for academic, biomedical, technical, and scientific topics, including search planning, source screening, synthesis, citation checks, and evidence logging.

community

affaan-m/everything-claude-code

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

community

forrestchang/andrej-karpathy-skills

Agent skill repository discovered by 10x-chat research.

community

langgenius/backend-code-review

Review backend code for quality, security, maintainability, and best practices based on established checklist rules. Use when the user requests a review, analysis, or improvement of backend files (e.g., `.py`) under the `api/` directory. Do NOT use for frontend files (e.g., `.tsx`, `.ts`, `.js`). Supports pending-change review, code snippets review, and file-focused review.

community
← More 研究＆データ分析 skills