malware-analysis

Solid

Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.

Data & Documents 46 stars 3 forks Updated 5 days ago MIT

Install

View on GitHub

Quality Score: 83/100

Stars 20%
56
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Malware Analysis Orchestrator Single entry point for malware analysis engagements. Routes to specialized sub-skills, carries findings between phases, and manages multi-sample workflows. ## How This Works You describe what you need — "analyze this sample", "I have 5 files to triage", "create detection rules from my findings" — and this orchestrator: 1. Determines which sub-skill to use based on your file type and intent 2. **Runs the analysis** using that sub-skill: Claude executes the static tooling, parses exported evidence, writes rules and reports itself 3. Records findings in a state file (`analysis_state.md`) 4. Recommends the next phase when the current one completes 5. Waits for your confirmation before proceeding You never need to invoke sub-skills directly. ## Execution Model - **Claude does the work on the host.** Hashing, `file`, PE parsing, strings, IOC extraction, macro/PDF/script deobfuscation, .NET decompilation, Procmon/Sysmon/tshark parsing, rule authoring and testing, report writing — all run by Claude with Bash. Do not turn a step into "ask the user to run X and paste the output" unless the tool is missing and cannot be installed. - **The only thing the analyst does by hand is execute the sample in the isolated VM** and export text evidence. `malware-dynamic-analysis` produces the runbook for that. - **Never execute a sample or any extracted stage on the host.** Static tooling only. Never upload a sample anywhere without explicit consent (hash look...

Details

Author
gl0bal01
Repository
gl0bal01/malware-analysis-claude-skills
Created
10 months ago
Last Updated
5 days ago
Language
Python
License
MIT

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Solid

malware-dynamic-analysis

Behavioral analysis of a sample executed in an isolated VM. Use after triage when runtime behavior, C2 traffic, dropped files, persistence, or injection must be observed. Claude produces a tailored VM runbook from triage predictions, then parses the exported text evidence (Procmon CSV, Sysmon JSON/CSV, tshark output, autoruns, strings) on the host to reconstruct behavior and extract IOCs. The analyst runs the VM; Claude never executes the sample.

46 Updated 5 days ago
gl0bal01
Web & Frontend Solid

malware-triage

Rapid static assessment, classification, and prioritization of malware samples. Use for the first look at any unknown file — hashes, file type, packing, imports, strings, initial IOCs, threat level, and the decision on which deep-analysis phase comes next. Claude runs the static tooling on the host itself; the sample is never executed.

46 Updated 5 days ago
gl0bal01
Data & Documents Solid

malware-report-writer

Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.

46 Updated 5 days ago
gl0bal01