Extracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, and pypykatz. Use when performing memory forensics or incident response on an LSASS or full memory dump and you need to recover credentials or Kerberos material for investigation.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-credentials-from-memory-dumpnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-credentials-from-memory-dump -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-credentials-from-memory-dump -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/extracting-credentials-from-memory-dumpgh skill install mukul975/Anthropic-Cybersecurity-Skills extracting-credentials-from-memory-dumpgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/extracting-credentials-from-memory-dump ~/.claude/skills/extracting-credentials-from-memory-dump # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/extracting-credentials-from-memory-dump ~/.agents/skills/extracting-credentials-from-memory-dump # Codex, Cursor, Gemini CLI, Copilot, OpenCode