building-automated-malware-submission-pipeline

# Building Automated Malware Submission Pipeline ## When to Use Use this skill when: - SOC teams face high volume of suspicious file alerts requiring sandbox analysis - Manual sandbox submission creates bottlenecks in alert triage workflow - Endpoint and email security tools quarantine files needing automated verdict determination - Incident response requires rapid malware family identification and IOC extraction **Do not use** for analyzing live malware samples in production environments — always use isolated sandbox infrastructure. ## Prerequisites - Sandbox environment: Cuckoo Sandbox, Joe Sandbox, Any.Run, or VMRay - VirusTotal API key (Enterprise for submission, free for lookup) - MalwareBazaar API access for known malware lookup - File collection mechanism: EDR quarantine API, email gateway export, network capture - Python 3.8+ with `requests`, `vt-py`, `pefile` libraries - Isolated analysis network with no production connectivity ## Workflow ### Step 1: Build File Collection Pipeline Collect suspicious files from multiple sources: ```python import requests import hashlib import os from pathlib import Path from datetime import datetime class MalwareCollector: def __init__(self, quarantine_dir="/opt/malware_quarantine"): self.quarantine_dir = Path(quarantine_dir) self.quarantine_dir.mkdir(exist_ok=True) def collect_from_edr(self, edr_api_url, api_token): """Pull quarantined files from CrowdStrike Falcon""" headers = {"Au...