mcpField
M
malware-triage

malware-triage

github.com/securityskillsSecurity0164 installsUpdated 9w ago
Repository

About malware-triage

A malware-analysis skill for security analysts who need to assess suspicious samples and produce actionable findings. It outlines safe handling, static and sandbox-based dynamic triage, behavior extraction, classification, and escalation criteria.

Key features

  1. 01Safe sample-handling guidance
  2. 02Static file and metadata checks
  3. 03Sandbox-based behavior monitoring
  4. 04Extract persistence and network indicators
  5. 05Classify findings and produce reports

Use cases

  1. 01Triage a suspicious file in isolation
  2. 02Collect hashes, strings, and network indicators
  3. 03Prepare detection guidance and a triage summary

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill malware-triage

After installing, type/malware-triagein Claude Code to confirm it loaded.

Details

From the project README

Malware Triage

Analyze suspicious samples safely and extract actionable indicators fast.

Safety First

  • Isolated VM or dedicated sandbox (Cuckoo/ANY.RUN/vendor sandbox), network simulated or sinkholed
  • Samples stored in password-protected archives, hash-named; never opened on analysis-adjacent hosts
  • Work from snapshots; revert after every detonation

1. Static Triage

  • Hashes (MD5/SHA256), file type, entropy (file, pestudio-style overview)
  • Strings: URLs, mutexes, registry paths, PDB paths, C2 patterns
  • PE specifics: imports of interest (network, process injection, crypto APIs), digital signature validity, packer detection (entropy + section names)
  • Document metadata (Office macros, embedded objects, remote templates)

2. Dynamic Detonation

  • Execute in sandbox with monitoring: file, registry, network, process activity
  • Capture: dropped files, persistence mechanism, C2 beacons (domains/IPs with ports/protocols)
  • Trigger-dependent malware: require user interaction simulation, geo/fate checks, or debugger awareness — escalate to debugging if silent

3. Behavior Extraction

  • Persistence: Run keys, services, scheduled tasks, WMI subscriptions
  • Injection: process hollowing, APC, SetWindowsHookEx targets
  • Exfiltration: DNS tunneling patterns, HTTP POST shapes, known protocol beacons
  • Defense evasion: AV service stops, AMSI/ETW patching, timestamp manipulation

4. Classification and Reporting

  • Family attribution via YARA rules against sample set; note confidence
  • Map observed behavior to ATT&CK techniques
  • Produce: IOCs (machine-readable, STIX if required), detection guidance (YARA + behavioral), and a one-page triage summary

Escalation Criteria

Deep-dive reversing (IDA/Ghidra) only when: C2 protocol reconstruction, config extraction, or unpacking is required for detection/response — not for curiosity.

Comments

Markdown supported