extracting-memory-artifacts-with-rekall

by mukul975

extracting-memory-artifacts-with-rekall guide for analyzing Windows memory images with Rekall. Learn install and usage patterns to find hidden processes, injected code, suspicious VADs, loaded DLLs, and network activity for Digital Forensics.

Stars0

Favorites0

Comments0

AddedMay 11, 2026

CategoryDigital Forensics

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall

Curation Score

This skill scores 78/100, which means it is a solid listing candidate for directory users who need Rekall-based memory forensics help. The repository provides a real workflow, concrete plugin coverage, and an executable script, so users can judge its fit and trigger it with less guesswork than a generic prompt, though setup and usage guidance are not fully polished.

78/100

Strengths

Clear incident-response use case for extracting memory artifacts from Windows memory images, with specific Rekall plugins named in the description and reference docs.
Operational artifacts are present: an `agent.py` script plus an API reference that shows session creation, hidden-process detection, and command-line examples.
Frontmatter is valid and includes domain, subdomain, version, license, and NIST CSF tags, which improves install decision clarity and trustworthiness.

Cautions

No install command in `SKILL.md`, so users may need to infer how to wire up dependencies and runtime setup.
The docs are helpful but not complete end-to-end; the file tree suggests a narrow workflow focused on Rekall memory analysis rather than broader incident-response coverage.

Memory Forensics Rekall Windows Artifacts Malware Analysis Reverse Engineering Forensics Security Operations

Overview

Overview of extracting-memory-artifacts-with-rekall skill

The extracting-memory-artifacts-with-rekall skill helps you analyze Windows memory images with Rekall to identify artifacts that matter in incident response: hidden processes, injected code, suspicious VAD regions, loaded DLLs, and network activity. It is best for analysts doing extracting-memory-artifacts-with-rekall for Digital Forensics who want a guided, repeatable workflow instead of assembling ad hoc Rekall commands.

What this skill is for

Use this skill when the job is to turn a memory dump into defensible findings: what is running, what is concealed, what looks injected, and what evidence supports that conclusion. The real value is speed with structure, not just running pslist once.

Who should use it

This is a fit for SOC analysts, DFIR responders, threat hunters, and red teamers validating detection logic in a lab. It is less useful if you only need a broad malware triage summary or if your evidence is not a Windows memory image.

What makes it different

The skill centers on Rekall plugins and analysis patterns that expose memory-only artifacts, especially pslist vs psscan comparisons and malfind/vadinfo checks. That makes it stronger for process hiding and code injection questions than a generic prompt that only asks for “memory forensics help.”

How to Use extracting-memory-artifacts-with-rekall skill

Install and locate the workflow

Install with npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall. For extracting-memory-artifacts-with-rekall install validation, open skills/extracting-memory-artifacts-with-rekall/SKILL.md first, then read references/api-reference.md for commands and scripts/agent.py for the execution pattern. Those files show the workflow more clearly than a quick repo skim.

Give the skill the right input

For good extracting-memory-artifacts-with-rekall usage, tell it: image path, capture type if known, Windows version or likely profile source, and the question you need answered. Strong input sounds like: “Analyze memory.raw for hidden processes, code injection, and suspicious network connections; prioritize artifacts that support an incident report.” Weak input like “check this dump” forces the model to guess too much.

Use a focused analysis sequence

Start broad with pslist, psscan, and netscan, then narrow with malfind, vadinfo, dlllist, and handles on suspicious PIDs. Compare active vs scanned processes to spot hiding, then inspect VAD permissions and loaded modules to confirm whether a process looks injected or hollowed. If you already know the suspect PID, ask for a PID-scoped pass instead of a full-dump sweep.

Read the repository in this order

First read references/api-reference.md for plugin names and command-line examples, then inspect scripts/agent.py to see how the session is created and how hidden-process logic is implemented. That ordering helps you adapt the extracting-memory-artifacts-with-rekall guide to your own lab or automation pipeline without copying brittle defaults.

extracting-memory-artifacts-with-rekall skill FAQ

Is this only for Windows memory analysis?

Mostly yes. The repository is built around Rekall memory image analysis and Windows-oriented artifacts like EPROCESS, VADs, DLLs, and kernel modules. If your case is Linux memory, disk-only triage, or live endpoint response without a dump, this skill is usually the wrong tool.

How does it compare with a normal prompt?

A normal prompt might mention Rekall commands, but the extracting-memory-artifacts-with-rekall skill gives you a more repeatable structure: what to run first, what to compare, and which findings are meaningful. That reduces guesswork when the image is noisy or when you need explainable results.

Is it beginner-friendly?

It is usable by beginners who know basic incident-response concepts, but the output is strongest when the user can name the artifact they care about. If you do not yet understand hidden processes, VAD anomalies, or DLL inspection, expect a learning curve before the skill feels precise.

When should I not use it?

Do not use it when you lack authorization, when you do not have a valid memory image, or when the question is better answered by endpoint telemetry, disk forensics, or YARA scanning. It is also a poor fit if you need a one-command “malware verdict” without artifact validation.

How to Improve extracting-memory-artifacts-with-rekall skill

Provide evidence constraints up front

The best extracting-memory-artifacts-with-rekall usage starts with constraints: image format, suspected time window, OS family, and what counts as a useful result. Say whether you want process injection indicators, hidden persistence, or network artifacts, because the analysis path changes materially.

Ask for artifact-backed output

Request findings tied to plugin evidence, not just narrative summaries. For example: “List hidden processes found by psscan but not pslist, then inspect each with malfind and dlllist, and explain which artifacts support suspicion.” That makes the result easier to audit and reuse in a report.

Watch for common failure modes

The main failure modes are unsupported profile detection, overconfident conclusions from a single plugin, and noisy results when every anomaly is treated as malicious. Improve the next pass by asking the skill to separate “interesting,” “suspicious,” and “confirmed” artifacts, then focus only on the highest-signal PIDs.

Iterate from triage to confirmation

A strong workflow is: broad enumeration, shortlist suspicious processes, then confirm with targeted inspection and cross-checks. If the first pass finds a hidden process, follow up with the exact PID, VAD range, DLL set, and any network artifacts so the extracting-memory-artifacts-with-rekall skill can narrow from discovery to explanation.

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

conducting-malware-incident-response

by mukul975

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

Incident Response

Favorites 0GitHub 0

analyzing-usb-device-connection-history

by mukul975

analyzing-usb-device-connection-history helps investigate USB device connection history on Windows using registry hives, event logs, and setupapi.dev.log for Digital Forensics, insider threat work, and incident response. It supports timeline reconstruction, device correlation, and removable-media evidence analysis.

Digital Forensics

Favorites 0GitHub 6.2k

analyzing-bootkit-and-rootkit-samples

by mukul975

analyzing-bootkit-and-rootkit-samples is a malware analysis skill for MBR, VBR, UEFI, and rootkit investigations. Use it to inspect boot sectors, firmware modules, and anti-rootkit indicators when compromise persists below the OS layer. It is suited for analysts who need a practical guide, clear workflow, and evidence-based triage for Malware Analysis.

Malware Analysis

Favorites 0GitHub 6.2k

extracting-browser-history-artifacts

by mukul975

extracting-browser-history-artifacts is a Digital Forensics skill for extracting browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge. Use it to turn browser profile files into timeline-ready evidence with repeatable, case-focused workflow guidance.

Digital Forensics

Favorites 0GitHub 0

analyzing-network-traffic-for-incidents

by mukul975

analyzing-network-traffic-for-incidents helps incident responders analyze PCAPs, flow logs, and packet captures to confirm C2, lateral movement, exfiltration, and exploitation attempts. Built for analyzing-network-traffic-for-incidents for Incident Response with Wireshark, Zeek, and NetFlow-style investigation.

Incident Response

Favorites 0GitHub 0

deobfuscating-javascript-malware

by mukul975

deobfuscating-javascript-malware helps analysts turn heavily obfuscated malicious JavaScript into readable code for malware analysis, phishing pages, web skimmers, droppers, and browser-delivered payloads. Use this deobfuscating-javascript-malware skill for structured deobfuscation, decode tracing, and controlled review when simple minification is not the issue.

Malware Analysis

Favorites 0GitHub 0

detecting-process-injection-techniques

by mukul975

detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

analyzing-macro-malware-in-office-documents

by mukul975

analyzing-macro-malware-in-office-documents helps malware analysts inspect malicious VBA in Word, Excel, and PowerPoint files, decode obfuscation, and extract IOCs, execution paths, and payload staging logic for phishing triage, incident response, and document malware analysis.

Malware Analysis

Favorites 0GitHub 0

collecting-indicators-of-compromise

by mukul975

collecting-indicators-of-compromise skill for extracting, enriching, scoring, and exporting IOCs from incident evidence. Use it for Security Audit workflows, threat intel sharing, and STIX 2.1 output when you need a practical collecting-indicators-of-compromise guide instead of a generic incident-response prompt.

Security Audit

Favorites 0GitHub 0

analyzing-golang-malware-with-ghidra

by mukul975

analyzing-golang-malware-with-ghidra helps analysts reverse engineer Go-compiled malware in Ghidra with workflows for function recovery, string extraction, build metadata, and dependency mapping. The analyzing-golang-malware-with-ghidra skill is useful for malware triage, incident response, and Security Audit tasks that need practical, Go-specific analysis steps.

Security Audit

Favorites 0GitHub 0

building-incident-timeline-with-timesketch

by mukul975

building-incident-timeline-with-timesketch helps DFIR teams build collaborative incident timelines in Timesketch by ingesting Plaso, CSV, or JSONL evidence, normalizing timestamps, correlating events, and documenting attack chains for incident triage and reporting.

Incident Triage

Favorites 0GitHub 6.1k

analyzing-linux-kernel-rootkits

by mukul975

analyzing-linux-kernel-rootkits helps DFIR and threat-hunting workflows detect Linux kernel rootkits with Volatility3 cross-view checks, rkhunter scans, and /proc vs /sys analysis for hidden modules, hooked syscalls, and tampered kernel structures. It is a practical analyzing-linux-kernel-rootkits guide for forensic triage.

Digital Forensics

Favorites 0GitHub 0

detecting-mimikatz-execution-patterns

by mukul975

detecting-mimikatz-execution-patterns helps analysts detect Mimikatz execution using command-line patterns, LSASS access signals, binary indicators, and memory artifacts. Use this detecting-mimikatz-execution-patterns skill install for Security Audit, hunting, and incident response with templates, references, and workflow guidance.

Security Audit

Favorites 0GitHub 0

detecting-rootkit-activity

by mukul975

detecting-rootkit-activity is a Malware Analysis skill for finding rootkit indicators such as hidden processes, hooked system calls, altered kernel structures, hidden modules, and covert network artifacts. It uses cross-view comparison and integrity checks to help validate suspicious hosts when standard tools disagree.

Malware Analysis

Favorites 0GitHub 6.2k

analyzing-browser-forensics-with-hindsight

by mukul975

analyzing-browser-forensics-with-hindsight helps Digital Forensics teams analyze Chromium browser artifacts with Hindsight, including history, downloads, cookies, autofill, bookmarks, saved credentials metadata, cache, and extensions. Use it to reconstruct web activity, review timelines, and investigate Chrome, Edge, Brave, and Opera profiles.

Digital Forensics

Favorites 0GitHub 6.2k

hunting-advanced-persistent-threats

by mukul975

hunting-advanced-persistent-threats is a threat-hunting skill for detecting APT-style activity across endpoint, network, and memory telemetry. It helps analysts build hypothesis-driven hunts, map findings to MITRE ATT&CK, and turn threat intel into practical queries and investigation steps instead of ad hoc searches.

Threat Hunting

Favorites 0GitHub 0