malware-analysis

Malware Analysis Skills Toolkit

Claude skills package for operational malware analysis — covering triage, dynamic analysis, detection engineering, and reporting. Does not cover deep static reverse engineering (e.g., Ghidra/IDA Pro disassembly).

💡 Want to learn the manual analysis techniques behind these skills? Check out the comprehensive Malware Analysis SOP covering traditional analysis methods and tools.

---

📦 What's Included

1 Orchestrator + 5 Sub-Skills + host-side scripts covering triage, dynamic analysis, detection engineering, and reporting. The skills are written as instructions to Claude Code: Claude runs the static tooling, parses exported evidence, writes and tests the rules, and drafts the report. You execute the sample in your isolated VM; everything else is done for you.

• SKILL.md (root) - Orchestrator — single entry point that routes to the right sub-skill, manages analysis state across phases, and supports multi-sample batch workflows. Just describe what you need.

1. malware-triage - Initial assessment and prioritization
2. malware-dynamic-analysis - Safe execution and behavior monitoring
3. specialized-file-analyzer - Non-PE file analysis (.NET, Office, PDF, scripts, HTA, disk images)
4. detection-engineer - Detection rules and IOC management
5. malware-report-writer - Professional report creation

---

🧠 How It Works (agentic)

These are not tutorials you read — they are instructions Claude Code executes. Claude runs the static tools on the host, parses the evidence you export from the VM, and produces the rules and report. The only manual step is detonating the sample in your isolated VM.

                          YOUR HOST (Claude Code + internet)
  ┌───────────────────────────────────────────────────────────────────────┐
  │  Triage            Claude runs: file · hash_calculator.py · pe_info.py  │
  │                    · strings (ASCII+UTF-16) · ioc_extract.py            │
  │                    → classification, priority, behavior predictions     │
  │                            │                                            │
  │                            ▼  emits a VM runbook tailored to predictions│
  └────────────────────────────┼──────────────────────────────────────────┘
                               │  runbook (filters, export commands)
        ┌──────────────────────▼───────────────────────┐
        │   ISOLATED VM (REMnux / FlareVM, no internet) │   ← you detonate here
        │   snapshot → monitor → execute → 15+ min →    │
        │   export TEXT evidence → revert               │
        └──────────────────────┬───────────────────────┘
                               │  evidence/ (Procmon CSV, Sysmon JSON, tshark, dropped files)
  ┌────────────────────────────▼──────────────────────────────────────────┐
  │  Dynamic           Claude runs: procmon_summary.py · sysmon_summary.py  │
  │                    · tshark exports → process tree, injection,          │
  │                    persistence, C2 + beacon interval, dropped files     │
  │  Detection         Sigma (+ATT&CK, UUIDs) · Suricata (SID≥1M) · hunts,  │
  │                    validated with `sigma check` / `suricata -T`         │
  │  Report            12-section report + YARA rule, tested with `yara`     │
  └───────────────────────────────────────────────────────────────────────┘

Claude never executes the sample or any extracted stage, and never uploads a sample (hash lookups only). See a real run in docs/example-triage.md.

---

🎯 Quick Skill Selector

Just describe what you need — the orchestrator (SKILL.md) routes automatically. The decision tree below is for reference if you want to invoke a specific sub-skill directly.

START: What do you need to do?

├─ "I need to quickly assess a sample" → Use: malware-triage
│
├─ "I need to execute malware safely and monitor it" → Use: malware-dynamic-analysis
│
├─ "I have a document/script/non-executable" → Use: specialized-file-analyzer
│  ├─ .NET/C# assembly (.exe with .NET)
│  ├─ Office document with macros (.docm, .xlsm)
│  ├─ PDF file
│  ├─ PowerShell/VBS/JavaScript/HTA
│  ├─ Archive (.zip, .rar, .7z)
│  ├─ Disk image (.iso, .img, .vhd, .vhdx)
│  ├─ Linux binary (ELF)
│  └─ Shortcut file (.lnk)
│
├─ "I need to create detection rules or defang IOCs" → Use: detection-engineer
│  ├─ YARA rules → Use: malware-report-writer
│  ├─ Sigma rules (SIEM) → Use: detection-engineer
│  ├─ Suricata rules (IDS) → Use: detection-engineer
│  └─ Defang IOCs → Use: detection-engineer
│
└─ "I need to write a malware analysis report" → Use: malware-report-writer

---

📊 Skills Comparison Matrix

Skill Name	When to Use	Primary Output
malware-triage	First look at unknown sample	Classification, priority, initial IOCs
malware-dynamic-analysis	Execute and monitor behavior	Behavioral IOCs, process tree, network traffic
specialized-file-analyzer	Non-PE files (docs, scripts, etc.)	Deobfuscated code, embedded payloads, IOCs
detection-engineer	Create detection rules, defang IOCs	Sigma/Suricata rules, hunting queries
malware-report-writer	Document findings professionally	Complete technical report, YARA rules

---

🚀 Getting Started

Install as a plugin (recommended)

/plugin marketplace add gl0bal01/malware-analysis-claude-skills
/plugin install malware-analysis

Then in any analysis workspace, just describe the task — the malware-analysis skill auto-triggers, or invoke it with /malware-analysis. Install pefile for PE parsing (pip install pefile); every other tool is optional and the skills degrade gracefully without it.

Install by git clone (personal skill)

git clone https://github.com/gl0bal01/malware-analysis-claude-skills ~/.claude/skills/malware-analysis
pip install pefile
python3 ~/.claude/skills/malware-analysis/scripts/ioc_extract.py --self-test   # verify

Only the orchestrator registers as a skill; it loads the five sub-skills by path. Skills locate their own scripts via $CLAUDE_PLUGIN_ROOT (plugin) or the skill directory (clone), so they work from any working directory.

Start analyzing

From your analysis workspace (not the skill repo):

"Triage samples/invoice.exe"
"I have 5 samples in samples/ — triage and prioritize them"
"Analyze samples/invoice.docm"
"Here is evidence/ from the VM run — what did it do?"

claude.ai (web) users: zip the repo and add it as a skill; the host scripts will not run there, so Claude falls back to asking you for tool output.

---

🔌 MCP Server Integrations (Optional)

MCP servers can automate manual steps like reputation lookups and sandbox execution. These are optional — every skill works without them.

MCP Server	What It Automates	API Key
VirusTotal	Hash/URL/domain reputation lookups	Free at virustotal.com
Threat.Zone	Automated sandbox execution	threat.zone
Threat Intel	abuse.ch, AbuseIPDB, GreyNoise, AlienVault OTX	Per-source
MISP	Team-wide IOC sharing	Self-hosted
Shodan	C2 infrastructure recon	Free at shodan.io
Volatility	Memory forensics via natural language	Local install

Recommended starting setup: VirusTotal + Threat Intel (abuse.ch). See references/mcp_integrations.md for full setup instructions.

---

🔐 Using with REMnux/FlareVM (Offline Analysis)

The Problem

Malware analysis VMs are typically network-isolated to prevent C2 communication. Claude Code requires internet access. Solution: Run Claude Code on your HOST machine, analyze exported evidence from the analysis VM.

Architecture

┌─────────────────────────────────────────────────────┐
│  HOST MACHINE (Internet-connected)                  │
│  • Claude Code + skills loaded                      │
│  • Analyzes exported evidence                       │
│  • Creates reports and detection rules              │
└──────────────────┬──────────────────────────────────┘
                   │ Evidence Transfer (shared folder / USB)
┌──────────────────▼──────────────────────────────────┐
│  ANALYSIS VM (Isolated - No Internet recommended)   │
│  REMnux / FlareVM                                   │
│  • Execute malware, run monitoring tools            │
│  • Export evidence in text formats                   │
└─────────────────────────────────────────────────────┘

Host Directory Structure

/malware-analysis/
├── samples/              # Original samples (DO NOT share with VM)
├── evidence/             # Evidence exported FROM analysis VM
│   ├── strings/          # strings output
│   ├── procmon/          # Process Monitor logs (CSV)
│   ├── wireshark/        # Network captures (text exports)
│   ├── sysmon/           # Sysmon event logs (JSON/CSV)
│   ├── memory/           # Memory dump analysis results
│   └── screenshots/      # Behavior screenshots
├── detections/           # Detection rules created by Claude Code
│   ├── yara/
│   ├── sigma/
│   └── suricata/
└── reports/              # Final deliverables

Workflow

1. Triage (Claude, host): hashes, file, pe_info.py, strings + IOC extraction, packing check, classification, behavior predictions
2. Runbook (Claude → you): a VM runbook tailored to the predictions — Procmon filters, Sysmon focus, expected network, and the exact export commands
3. Execution (you, VM): snapshot → start monitoring → execute → observe 15+ min → run the export commands (Procmon CSV, Sysmon JSON, tshark text, autoruns CSV, dropped files) → revert
4. Analysis (Claude, host): procmon_summary.py, sysmon_summary.py, tshark exports, memory strings → execution chain, persistence, C2, IOCs, ATT&CK
5. Deliverables (Claude, host): Sigma/Suricata/hunting rules (tested where tooling exists), YARA rule, 12-section report

What Claude Code CAN and CANNOT Do

CAN: Run static tools on the host (file, strings, pe_info.py, upx -d, olevba, pdfid, ilspycmd, 7z, readelf), decode obfuscated scripts in Python, parse Procmon CSV / Sysmon JSON-CSV-JSONL / tshark exports with the bundled scripts, run tshark and evtx_dump conversions if installed, write and test YARA/Sigma/Suricata rules, write the report.

CANNOT: Execute malware or extracted stages (that is the VM's job). Read PML directly (convert in Procmon). Debug interactively (dnSpy/x64dbg stay in the VM; bring the decrypted strings back as text).

Troubleshooting

Q: Claude Code refuses to read my evidence file? A: Ensure it's in text format (CSV, JSON, TXT), not binary (PML, PCAP, EVTX).

Q: How do I convert PCAP to text?

tshark -r capture.pcap -Y http -T fields -e http.host -e http.request.uri > http_traffic.txt

Q: How do I convert EVTX?

Get-WinEvent -Path sysmon.evtx | Select Id,TimeCreated,Message | ConvertTo-Json -Depth 3 | Out-File -Encoding utf8 sysmon.json

Or on the host: pip install evtx && evtx_dump --format jsonl sysmon.evtx > sysmon.jsonl — sysmon_summary.py reads both.

Q: Claude Code says file is too large? Filter first: grep "malware.exe" procmon_huge.csv > procmon_filtered.csv

---

📚 Sub-Skill Details

Skill	Claude does	Bundled
malware-triage	file, hashes, pe_info.py (headers, sections, entropy, imports, packing verdict, signature, overlay), ASCII+UTF-16 strings, IOC extraction, classification, threat level, behavior predictions, priority	scripts/pe_info.py, scripts/hash_calculator.py, references/indicators.md, references/triage_checklist.md