cyber-extracting-memory-artifacts-with-rekall

name	cyber-extracting-memory-artifacts-with-rekall
description	Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.
hide	true

YURI skill adapter

Authoritative source: .claude/skills/cyber-extracting-memory-artifacts-with-rekall/SKILL.md

Authoritative source SHA-256: 0d710c3dc90c480b6262152bb924a20bd14b99c77b9952309068d826251ae669

Source class: cyber-armed

Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run node _SYSTEM/Scripts/skill-recall.mjs --show cyber-extracting-memory-artifacts-with-rekall and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.