/malware-analysis-claude-skills

name: malware-analysis
description: Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.

Malware Analysis Orchestrator

Single entry point for malware analysis engagements. Routes to specialized sub-skills, carries findings between phases, and manages multi-sample workflows.

How This Works

You describe what you need — "analyze this sample", "I have 5 files to triage", "create detection rules from my findings" — and this orchestrator:

1. Determines which sub-skill to use based on your file type and intent 2. **Runs the analysis** using that sub-skill: Claude executes the static tooling, parses exported evidence, writes rules and reports itself 3. Records findings in a state file (`analysis_state.md`) 4. Recommends the next phase when the current one completes 5. Waits for your confirmation before proceeding

You never need to invoke sub-skills directly.

Execution Model

• **Claude does the work on the host.** Hashing, `file`, PE parsing, strings, IOC extraction, macro/PDF/script deobfuscation, .NET decompilation, Procmon/Sysmon/tshark parsing, rule authoring and testing, report writing — all run by Claude with Bash. Do not turn a step into "ask the user to run X and paste the output" unless the tool is missing and cannot be installed.
• **The only thing the analyst does by hand is execute the sample in the isolated VM** and export text evidence. `malware-dynamic-analysis` produces the runbook for that.
• **Never execute a sample or any extracted stage on the host.** Static tooling only. Never upload a sample anywhere without explicit consent (hash lookups are fine).
• **Locate skill files.** The sub-skill `SKILL.md` files and the scripts below ship in this skill's directory tree. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once — when installed as a plugin `$CLAUDE_PLUGIN_ROOT` points at the install; otherwise it is this skill folder. The working directory is the user's analysis workspace, so read sub-skills and run scripts by absolute path, e.g. `python3 "$R"/scripts/ioc_extract.py` and read `"$R"/malware-triage/SKILL.md`.
• **Bundled scripts** (paths below are relative to `$R`):

| Script | Used by | Purpose | |--------|---------|---------| | `scripts/ioc_extract.py` | all phases | extract + defang IOCs from any text (`--format csv/json`, `--refang`) | | `malware-triage/scripts/pe_info.py` | triage | PE headers, sections, entropy, imports, packing verdict, signature, overlay, resources (needs `pefile`) | | `malware-triage/scripts/hash_calculator.py` | triage | MD5/SHA1/SHA256 | | `malware-dynamic-analysis/scripts/procmon_summary.py` | dynamic | Procmon CSV → process tree, file/registry writes, network, persistence flags | | `malware-dynamic-analysis/scripts/sysmon_summary.py` | dynamic | Sysmon JSON/CSV/evtx_dump → tree, network + beaconing, DNS, injection, persistence |

Run `--self-test` on any of them if in doubt.

• **Host tool check** at engagement start (once), then degrade gracefully and say what is missing:

  command -v file strings upx 7z yara tshark olevba oledump.py pdfid.py ilspycmd js-beautify readelf jq; python3 -c "import pefile" 2>&1 | tail -1

• **Big outputs** go to files under the engagement workspace; inspect with `wc -l`, `head`, `grep`, and the summary scripts — never `cat` a strings dump or a Procmon CSV.

Routing Logic

| Signal | Routes To | |--------|-----------| | Unknown file / "what is this?" / initial assessment | `malware-triage` | | PE executable after triage, needing behavior monitoring | `malware-dynamic-analysis` | | .NET / Office / PDF / script / archive / LNK / ELF / HTA / ISO / IMG / VHD / VHDX | `specialized-file-analyzer` | | "Create detection rules" / post-analysis phase | `detection-engineer` | | "Write the report" / final documentation phase | `malware-report-writer` | | YARA rules specifically | `malware-report-writer` (not detection-engineer) |

**Triage is always the entry point for new samples.** The table above describes which *analysis* skill follows triage.

File Type Priority Order

When routing by file type, use the `file` command output. Check in this order — first match wins:

1. "Mono/.Net assembly" → read and follow `specialized-file-analyzer/SKILL.md` 2. "Microsoft Office Document" → read and follow `specialized-file-analyzer/SKILL.md` 3. "PDF document" → read and follow `specialized-file-analyzer/SKILL.md` 4. "ELF" → read and follow `specialized-file-analyzer/SKILL.md` 5. "PE32" / "PE64" (only if .NET was NOT matched) → read and follow `malware-triage/SKILL.md`, then `malware-dynamic-analysis/SKILL.md` 6. "MS Windows shortcut" (LNK) → read and follow `specialized-file-analyzer/SKILL.md` 7. ASCII text / script content → read and follow `specialized-file-analyzer/SKILL.md` 8. Archive formats (Zip, RAR, 7z) → read and follow `specialized-file-analyzer/SKILL.md` 9. HTML Application (.hta) → read and follow `specialized-file-analyzer/SKILL.md` 10. ISO/IMG disk images → read and follow `specialized-file-analyzer/SKILL.md` (mount/extract, then analyze contents) 11. VHD/VHDX virtual hard disks → read and follow `specialized-file-analyzer/SKILL.md` (mount/extract, then analyze contents) 12. "data" / zero-byte / unrecognized → read and follow `malware-triage/SKILL.md` for manual assessment

**.NET is the key ambiguity:** `file` outputs both "PE32" and "Mono/.Net assembly" for .NET assemblies. Always check for .NET before checking for PE.

Phase Sequence

Each sample follows this sequence:

Triage → [Dynamic Analysis OR Specialized File Analysis] → Detection Engineering → Report Writing

• **Triage** is always first — read and follow `malware-triage/SKILL.md`
• **Dynamic analysis** for PE