New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Extracting Memory Artifacts With Rekall

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection.

Apache-2.0Auto-check passedSecurity

Install Extracting Memory Artifacts With Rekall

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills extracting-memory-artifacts-with-rekall --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/extracting-memory-artifacts-with-rekall .claude/skills/extracting-memory-artifacts-with-rekall && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
extracting-memory-artifacts-with-rekall
GitHub stars
34k
Token cost
~642 tokens
SKILL.md length
143 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection.

  • Works in 5 steps: Load memory image and auto-detect profile → Run pslist and psscan to find hidden… → Use malfind to detect injected/hollowed… → …
  • Tasks that involve Digital forensics
  • SKILL.md covers When to Use, Prerequisites, Instructions and Examples
  • Runs Python scripts from its folder; reaches github.com

What it does

Extracting Memory Artifacts With Rekall is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.

Its SKILL.md is about 640 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Digital forensics and Incident response. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Digital forensics
  • Tasks that involve Incident response

Example prompts

  • “Use the extracting-memory-artifacts-with-rekall skill to use Rekall memory forensics framework to analyze memory dumps for process hollowing…”
  • “/extracting-memory-artifacts-with-rekall”

Requirements

  • Python 3

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Load memory image and auto-detect profile
  2. Run pslist and psscan to find hidden processes
  3. Use malfind to detect injected/hollowed code in process VADs
  4. Examine network connections with netscan
  5. Extract suspicious DLLs and drivers with dlllist/modules

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Extracting Memory Artifacts With Rekall loads about 642 tokens when it runs, and up to ~1.1k if it reads all its reference files. Until then it costs about 93 tokens; SKILL.md has 143 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~93
When it runs · the whole SKILL.md, loaded when a task matches
~642
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 143 words, ~642 tokens.

Download SKILL.mdSave it as .claude/skills/extracting-memory-artifacts-with-rekall/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
extracting-memory-artifacts-with-rekall
description
Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.
domain
cybersecurity
subdomain
security-operations
tags
memory-forensics, rekall, process-hollowing, code-injection, vad-analysis, incident-response, security-operations
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
DE.CM-01, RS.MA-01, GV.OV-01, DE.AE-02
mitre_attack
T1078, T1190, T1059, T1055, T1005

Extracting Memory Artifacts with Rekall

When to Use

  • When performing authorized security testing that involves extracting memory artifacts with rekall
  • When analyzing malware samples or attack artifacts in a controlled environment
  • When conducting red team exercises or penetration testing engagements
  • When building detection capabilities based on offensive technique understanding

Prerequisites

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Use Rekall to analyze memory dumps for signs of compromise including process injection, hidden processes, and suspicious network connections.

python
from rekall import session
from rekall import plugins

# Create a Rekall session with a memory image
s = session.Session(
    filename="/path/to/memory.raw",
    autodetect=["rsds"],
    profile_path=["https://github.com/google/rekall-profiles/raw/master"]
)

# List processes
for proc in s.plugins.pslist():
    print(proc)

# Detect injected code
for result in s.plugins.malfind():
    print(result)

Key analysis steps:

  1. Load memory image and auto-detect profile
  2. Run pslist and psscan to find hidden processes
  3. Use malfind to detect injected/hollowed code in process VADs
  4. Examine network connections with netscan
  5. Extract suspicious DLLs and drivers with dlllist/modules

Examples

python
from rekall import session
s = session.Session(filename="memory.raw")
# Compare pslist vs psscan for hidden processes
pslist_pids = set(p.pid for p in s.plugins.pslist())
psscan_pids = set(p.pid for p in s.plugins.psscan())
hidden = psscan_pids - pslist_pids
print(f"Hidden PIDs: {hidden}")

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/extracting-memory-artifacts-with-rekall of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Extracting Memory Artifacts With Rekall next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Extracting Memory Artifacts With Rekall compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Extracting Memory Artifacts With Rekall this skillmukul975/Anthropic-Cybersecurity-Skills34k—~642Automated safety check: PassApache-2.0
Incident Responsehypnguyen1209/offensive-claude388—~2.5kAutomated safety check: PassMIT
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence
Ir VelociraptorAgentSecOps/SecOpsAgentKit2201 repos~3.1kAutomated safety check: PassCustom licence
Incident Response NetworkLeoYeAI/openclaw-master-skills2.2k—~5kAutomated safety check: PassApache-2.0
Digital Forensicssickn33/agentic-awesome-skills47k1 repos~495Automated safety check: PassMIT

Similar skills

  • Incident Response

    hypnguyen1209/offensive-claude

    A skill your agent uses when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining…

    388 GitHub stars~2.5k tokensUpdated 12 days ago
    SecurityAuto-check passed

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Ir Velociraptor

    AgentSecOps/SecOpsAgentKit

    Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.

    220 GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed

  • Incident Response Network

    LeoYeAI/openclaw-master-skills

    Network forensics evidence collection and analysis during security incidents.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Digital Forensics

    sickn33/agentic-awesome-skills

    Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

    47k GitHub starsUsed in 1 repo~495 tokens
    SecurityAuto-check passed

  • Incident Response

    alirezarezvani/claude-skills

    A skill your agent uses when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.

    28k GitHub stars~3.8k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Extracting Memory Artifacts With Rekall

What does Extracting Memory Artifacts With Rekall do?

Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Extracting Memory Artifacts With Rekall is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection.

When should I use Extracting Memory Artifacts With Rekall?

Extracting Memory Artifacts With Rekall fits situations like: tasks that involve Digital forensics; tasks that involve Incident response.

How do I install Extracting Memory Artifacts With Rekall in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall -a claude-code`. Or copy the skill folder (skills/extracting-memory-artifacts-with-rekall in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/extracting-memory-artifacts-with-rekall in your project. Claude Code loads it when a task matches its description.

How do I install Extracting Memory Artifacts With Rekall in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall -a codex`. Or copy the skill folder (skills/extracting-memory-artifacts-with-rekall in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/extracting-memory-artifacts-with-rekall in your project. Codex loads it when a task matches its description.

Can I use Extracting Memory Artifacts With Rekall in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill extracting-memory-artifacts-with-rekall -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/extracting-memory-artifacts-with-rekall, .gemini/skills/extracting-memory-artifacts-with-rekall, .github/skills/extracting-memory-artifacts-with-rekall and .opencode/skills/extracting-memory-artifacts-with-rekall in your project.

What does Extracting Memory Artifacts With Rekall need to run?

Going by SKILL.md and its folder, Extracting Memory Artifacts With Rekall needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Extracting Memory Artifacts With Rekall access the network?

SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Extracting Memory Artifacts With Rekall safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Extracting Memory Artifacts With Rekall use?

Extracting Memory Artifacts With Rekall is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Extracting Memory Artifacts With Rekall use?

About 642 tokens (SKILL.md is roughly 2.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 413 tokens, read only when the agent opens those files.

What are the alternatives to Extracting Memory Artifacts With Rekall?

Skills that share tags, products or a category with Extracting Memory Artifacts With Rekall: Incident Response (hypnguyen1209/offensive-claude, 388 stars), Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars), Ir Velociraptor (AgentSecOps/SecOpsAgentKit, 220 stars) and Incident Response Network (LeoYeAI/openclaw-master-skills, 2.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Extracting Memory Artifacts With Rekall?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.