Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekallnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/extracting-memory-artifacts-with-rekallgh skill install mukul975/Anthropic-Cybersecurity-Skills extracting-memory-artifacts-with-rekallgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/extracting-memory-artifacts-with-rekall ~/.claude/skills/extracting-memory-artifacts-with-rekall # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/extracting-memory-artifacts-with-rekall ~/.agents/skills/extracting-memory-artifacts-with-rekall # Codex, Cursor, Gemini CLI, Copilot, OpenCode