Name: malware-triage
Author: securityskills

Imported from securityskills/skills (malware-analysis/malware-triage/SKILL.md). Install upstream with npx skills add securityskills/skills --skill malware-triage. Copyright stays with the author.

Malware Triage

Analyze suspicious samples safely and extract actionable indicators fast.

Safety First

Isolated VM or dedicated sandbox (Cuckoo/ANY.RUN/vendor sandbox), network simulated or sinkholed
Samples stored in password-protected archives, hash-named; never opened on analysis-adjacent hosts
Work from snapshots; revert after every detonation

1. Static Triage

Hashes (MD5/SHA256), file type, entropy (file, pestudio-style overview)
Strings: URLs, mutexes, registry paths, PDB paths, C2 patterns
PE specifics: imports of interest (network, process injection, crypto APIs), digital signature validity, packer detection (entropy + section names)
Document metadata (Office macros, embedded objects, remote templates)

2. Dynamic Detonation

Execute in sandbox with monitoring: file, registry, network, process activity
Capture: dropped files, persistence mechanism, C2 beacons (domains/IPs with ports/protocols)
Trigger-dependent malware: require user interaction simulation, geo/fate checks, or debugger awareness — escalate to debugging if silent

3. Behavior Extraction

Persistence: Run keys, services, scheduled tasks, WMI subscriptions
Injection: process hollowing, APC, SetWindowsHookEx targets
Exfiltration: DNS tunneling patterns, HTTP POST shapes, known protocol beacons
Defense evasion: AV service stops, AMSI/ETW patching, timestamp manipulation

4. Classification and Reporting

Family attribution via YARA rules against sample set; note confidence
Map observed behavior to ATT&CK techniques
Produce: IOCs (machine-readable, STIX if required), detection guidance (YARA + behavioral), and a one-page triage summary

Escalation Criteria

Deep-dive reversing (IDA/Ghidra) only when: C2 protocol reconstruction, config extraction, or unpacking is required for detection/response — not for curiosity.

{ "ocm": "1", "id": "securityskills-skills-malware-triage", "kind": "skill", "name": "malware-triage", "description": "Safely triage unknown malware samples — static indicators, sandbox execution, behavior extraction, and reporting. Use when analyzing suspicious files during investigations.", "publisher": "securityskills", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Safely triage unknown malware samples — static indicators, sandbox execution, behavior extraction, and reporting. Use when analyzing suspicious files during investigations." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/securityskills/skills", "path": "malware-analysis/malware-triage/SKILL.md", "ref": "HEAD", "url": "https://github.com/securityskills/skills/blob/HEAD/malware-analysis/malware-triage/SKILL.md", "key": "securityskills/skills/malware-analysis/malware-triage/SKILL.md" } }, "instructions": "# Malware Triage\n\nAnalyze suspicious samples safely and extract actionable indicators fast.\n\n## Safety First\n\n- Isolated VM or dedicated sandbox (Cuckoo/ANY.RUN/vendor sandbox), network simulated or sinkholed\n- Samples stored in password-protected archives, hash-named; never opened on analysis-adjacent hosts\n- Work from snapshots; revert after every detonation\n\n## 1. Static Triage\n\n- Hashes (MD5/SHA256), file type, entropy (`file`, `pestudio`-style overview)\n- Strings: URLs, mutexes, registry paths, PDB paths, C2 patterns\n- PE specifics: imports of interest (network, process injection, crypto ", "cost": { "context_tokens": 468 } }

malware-triage

About

Malware Triage

Safety First

1. Static Triage

2. Dynamic Detonation

3. Behavior Extraction

4. Classification and Reporting

Escalation Criteria

Use it

Manifest

Reviews