Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    vmware mem forensics

    1

    Automated triage and secret extraction for VMware .vmem and .vmdk memory forensics.

    $5

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    vmware mem forensics

    vmware mem forensics

    Example session with this skill installed

    I have a 2GB .vmem file from a suspicious Windows server. I need to triage it for credentials and identify the machine's role. Walk me through the commands.

    • Read your context and instructions
    • Compiled the vmware mem forensics

    I will begin the forensic triage of the 2GB vmem file. We will focus on structural extraction of hashes and secrets, as plaintext string searches are often unreliable for binary credential storage.

    Forensic Triage Plan for Windows Memory Dump

    StepGoalCommandExpected Output
    1. InfoConfirm OS/Archvol -f mem.vmem windows.infoKernel version, symbols, and architecture.
    2. HashesLocal SAM Hashesvol -f mem.vmem windows.hashdumpNTLM hashes for local accounts (e.g., Administrator).
    3. LSAMachine Secretsvol -f mem.vmem windows.registry.lsadumpDPAPI_SYSTEM, NL$KM, and LSA secrets.
    4. RoleIdentify Rolevol -f mem.vmem windows.svclistSearch for NTDS (DC) or LanmanServer.
    5. CarvingDPAPI Blobs`strings -el mem.vmemgrep -a "01 00 00 00 d0 8c 9d df"`

    Technical Execution Details

    To convert the vmdk if you decide to pivot to disk analysis later:

    
# Convert vmdk to raw for standard forensic tools
qemu-img convert -O raw evidence-000001.vmdk evidence_full.raw

    To run the primary triage via the local environment:

    ~/tools/volenv/bin/vol -q -f mem.vmem windows.hashdump
~/tools/volenv/bin/vol -q -f mem.vmem windows.registry.lsadump

    Next steps

    1. Run windows.hashdump first; local hashes are often reused across the domain.
    2. Check pslist for lsass.exe PID to verify if a credential dumper was recently active.
    3. If hashes are found, attempt Pass-the-Hash (PtH) before performing deep string analysis.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Extract NTLM hashes from Windows memory dumps for credential auditing.Identify machine roles and active services from vmem snapshots.Carve Kerberos tickets and DPAPI blobs from raw memory images.Convert VMware vmdk snapshots to raw formats for forensic analysis.

    About this skill

    The problem

    Manual forensic triage of VMware memory dumps is slow and prone to false negatives. Grepping for plaintext passwords often fails because credentials live in binary structures like DPAPI blobs and Kerberos tickets.

    What it does

    • Identifies high-value targets like SAM hashes and LSA secrets using Volatility3.
    • Handles vmdk to raw conversion using qemu-img for disk forensics.
    • Carves binary structures including DPAPI blobs and ASN.1 Kerberos tickets.
    • Triages machine roles by analyzing svclist and registry keys to prioritize DC vs workstation artifacts.

    Frameworks & tools

    Volatility3, qemu-utils, Python, and strings (UTF-16LE/ASCII).

    Why this beats prompting it yourself

    Standard LLMs suggest generic 'grep' commands that miss 90% of memory-resident secrets. This skill enforces a structured triage order, focusing on structural analysis of binary blobs and machine-specific secrets that generic prompts overlook.

    Use cases

    • Extracting local SAM hashes from a vmem file for Pass-the-Hash testing.
    • Decrypting DPAPI blobs using machine keys recovered from lsadump.
    • Converting delta vmdk snapshots to raw images for disk-level analysis.
    • Confirming OS versions and active process lists from a memory capture.

    Known limitations

    LSAssy plugin is not supported; use native Volatility3 plugins. Large vmem files (2GB+) require 1-3 minutes per plugin execution.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 7 days ago

    • Passed all security checks, Safe to install

    Listed7 days ago

    What's inside

    Frequently Asked Questions