/malware-analysis-claude-skills
Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases,
$ npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-analysis-claude-skills --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/malware-analysis-claude-skills
Context preview
The summary Claude sees to decide when to auto-load this skill.
Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases,
SKILL.md
malware-analysis-claude-skills.SKILL.mdname: malware-analysis
description: Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.
Malware Analysis Orchestrator
Single entry point for malware analysis engagements. Routes to specialized sub-skills, carries findings between phases, and manages multi-sample workflows.
How This Works
You describe what you need — "analyze this sample", "I have 5 files to triage", "create detection rules from my findings" — and this orchestrator:
1. Determines which sub-skill to use based on your file type and intent 2. **Runs the analysis** using that sub-skill: Claude executes the static tooling, parses exported evidence, writes rules and reports itself 3. Records findings in a state file (`analysis_state.md`) 4. Recommends the next phase when the current one completes 5. Waits for your confirmation before proceeding
You never need to invoke sub-skills directly.
Execution Model
- **Claude does the work on the host.** Hashing, `file`, PE parsing, strings, IOC extraction, macro/PDF/script deobfuscation, .NET decompilation, Procmon/Sysmon/tshark parsing, rule authoring and testing, report writing — all run by Claude with Bash. Do not turn a step into "ask the user to run X and paste the output" unless the tool is missing and cannot be installed.
- **The only thing the analyst does by hand is execute the sample in the isolated VM** and export text evidence. `malware-dynamic-analysis` produces the runbook for that.
- **Never execute a sample or any extracted stage on the host.** Static tooling only. Never upload a sample anywhere without explicit consent (hash lookups are fine).
- **Locate skill files.** The sub-skill `SKILL.md` files and the scripts below ship in this skill's directory tree. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once — when installed as a plugin `$CLAUDE_PLUGIN_ROOT` points at the install; otherwise it is this skill folder. The working directory is the user's analysis workspace, so read sub-skills and run scripts by absolute path, e.g. `python3 "$R"/scripts/ioc_extract.py` and read `"$R"/malware-triage/SKILL.md`.
- **Bundled scripts** (paths below are relative to `$R`):
| Script | Used by | Purpose | |--------|---------|---------| | `scripts/ioc_extract.py` | all phases | extract + defang IOCs from any text (`--format csv/json`, `--refang`) | | `malware-triage/scripts/pe_info.py` | triage | PE headers, sections, entropy, imports, packing verdict, signature, overlay, resources (needs `pefile`) | | `malware-triage/scripts/hash_calculator.py` | triage | MD5/SHA1/SHA256 | | `malware-dynamic-analysis/scripts/procmon_summary.py` | dynamic | Procmon CSV → process tree, file/registry writes, network, persistence flags | | `malware-dynamic-analysis/scripts/sysmon_summary.py` | dynamic | Sysmon JSON/CSV/evtx_dump → tree, network + beaconing, DNS, injection, persistence |
Run `--self-test` on any of them if in doubt.
- **Host tool check** at engagement start (once), then degrade gracefully and say what is missing:
command -v file strings upx 7z yara tshark olevba oledump.py pdfid.py ilspycmd js-beautify readelf jq; python3 -c "import pefile" 2>&1 | tail -1
- **Big outputs** go to files under the engagement workspace; inspect with `wc -l`, `head`, `grep`, and the summary scripts — never `cat` a strings dump or a Procmon CSV.
Routing Logic
| Signal | Routes To | |--------|-----------| | Unknown file / "what is this?" / initial assessment | `malware-triage` | | PE executable after triage, needing behavior monitoring | `malware-dynamic-analysis` | | .NET / Office / PDF / script / archive / LNK / ELF / HTA / ISO / IMG / VHD / VHDX | `specialized-file-analyzer` | | "Create detection rules" / post-analysis phase | `detection-engineer` | | "Write the report" / final documentation phase | `malware-report-writer` | | YARA rules specifically | `malware-report-writer` (not detection-engineer) |
**Triage is always the entry point for new samples.** The table above describes which *analysis* skill follows triage.
File Type Priority Order
When routing by file type, use the `file` command output. Check in this order — first match wins:
1. "Mono/.Net assembly" → read and follow `specialized-file-analyzer/SKILL.md` 2. "Microsoft Office Document" → read and follow `specialized-file-analyzer/SKILL.md` 3. "PDF document" → read and follow `specialized-file-analyzer/SKILL.md` 4. "ELF" → read and follow `specialized-file-analyzer/SKILL.md` 5. "PE32" / "PE64" (only if .NET was NOT matched) → read and follow `malware-triage/SKILL.md`, then `malware-dynamic-analysis/SKILL.md` 6. "MS Windows shortcut" (LNK) → read and follow `specialized-file-analyzer/SKILL.md` 7. ASCII text / script content → read and follow `specialized-file-analyzer/SKILL.md` 8. Archive formats (Zip, RAR, 7z) → read and follow `specialized-file-analyzer/SKILL.md` 9. HTML Application (.hta) → read and follow `specialized-file-analyzer/SKILL.md` 10. ISO/IMG disk images → read and follow `specialized-file-analyzer/SKILL.md` (mount/extract, then analyze contents) 11. VHD/VHDX virtual hard disks → read and follow `specialized-file-analyzer/SKILL.md` (mount/extract, then analyze contents) 12. "data" / zero-byte / unrecognized → read and follow `malware-triage/SKILL.md` for manual assessment
**.NET is the key ambiguity:** `file` outputs both "PE32" and "Mono/.Net assembly" for .NET assemblies. Always check for .NET before checking for PE.
Phase Sequence
Each sample follows this sequence:
Triage → [Dynamic Analysis OR Specialized File Analysis] → Detection Engineering → Report Writing
- **Triage** is always first — read and follow `malware-triage/SKILL.md`
- **Dynamic analysis** for PE
Read more
name: malware-analysis description: Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.
Malware Analysis Orchestrator
Single entry point for malware analysis engagements. Routes to specialized sub-skills, carries findings between phases, and manages multi-sample workflows.
How This Works
You describe what you need — "analyze this sample", "I have 5 files to triage", "create detection rules from my findings" — and this orchestrator:
1. Determines which sub-skill to use based on your file type and intent 2. **Runs the analysis** using that sub-skill: Claude executes the static tooling, parses exported evidence, writes rules and reports itself 3. Records findings in a state file (`analysis_state.md`) 4. Recommends the next phase when the current one completes 5. Waits for your confirmation before proceeding
You never need to invoke sub-skills directly.
Execution Model
- **Claude does the work on the host.** Hashing, `file`, PE parsing, strings, IOC extraction, macro/PDF/script deobfuscation, .NET decompilation, Procmon/Sysmon/tshark parsing, rule authoring and testing, report writing — all run by Claude with Bash. Do not turn a step into "ask the user to run X and paste the output" unless the tool is missing and cannot be installed.
- **The only thing the analyst does by hand is execute the sample in the isolated VM** and export text evidence. `malware-dynamic-analysis` produces the runbook for that.
- **Never execute a sample or any extracted stage on the host.** Static tooling only. Never upload a sample anywhere without explicit consent (hash lookups are fine).
- **Locate skill files.** The sub-skill `SKILL.md` files and the scripts below ship in this skill's directory tree. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once — when installed as a plugin `$CLAUDE_PLUGIN_ROOT` points at the install; otherwise it is this skill folder. The working directory is the user's analysis workspace, so read sub-skills and run scripts by absolute path, e.g. `python3 "$R"/scripts/ioc_extract.py` and read `"$R"/malware-triage/SKILL.md`.
- **Bundled scripts** (paths below are relative to `$R`):
| Script | Used by | Purpose | |--------|---------|---------| | `scripts/ioc_extract.py` | all phases | extract + defang IOCs from any text (`--format csv/json`, `--refang`) | | `malware-triage/scripts/pe_info.py` | triage | PE headers, sections, entropy, imports, packing verdict, signature, overlay, resources (needs `pefile`) | | `malware-triage/scripts/hash_calculator.py` | triage | MD5/SHA1/SHA256 | | `malware-dynamic-analysis/scripts/procmon_summary.py` | dynamic | Procmon CSV → process tree, file/registry writes, network, persistence flags | | `malware-dynamic-analysis/scripts/sysmon_summary.py` | dynamic | Sysmon JSON/CSV/evtx_dump → tree, network + beaconing, DNS, injection, persistence |
Run `--self-test` on any of them if in doubt.
- **Host tool check** at engagement start (once), then degrade gracefully and say what is missing:
command -v file strings upx 7z yara tshark olevba oledump.py pdfid.py ilspycmd js-beautify readelf jq; python3 -c "import pefile" 2>&1 | tail -1
- **Big outputs** go to files under the engagement workspace; inspect with `wc -l`, `head`, `grep`, and the summary scripts — never `cat` a strings dump or a Procmon CSV.
Routing Logic
| Signal | Routes To | |--------|-----------| | Unknown file / "what is this?" / initial assessment | `malware-triage` | | PE executable after triage, needing behavior monitoring | `malware-dynamic-analysis` | | .NET / Office / PDF / script / archive / LNK / ELF / HTA / ISO / IMG / VHD / VHDX | `specialized-file-analyzer` | | "Create detection rules" / post-analysis phase | `detection-engineer` | | "Write the report" / final documentation phase | `malware-report-writer` | | YARA rules specifically | `malware-report-writer` (not detection-engineer) |
**Triage is always the entry point for new samples.** The table above describes which *analysis* skill follows triage.
File Type Priority Order
When routing by file type, use the `file` command output. Check in this order — first match wins:
1. "Mono/.Net assembly" → read and follow `specialized-file-analyzer/SKILL.md` 2. "Microsoft Office Document" → read and follow `specialized-file-analyzer/SKILL.md` 3. "PDF document" → read and follow `specialized-file-analyzer/SKILL.md` 4. "ELF" → read and follow `specialized-file-analyzer/SKILL.md` 5. "PE32" / "PE64" (only if .NET was NOT matched) → read and follow `malware-triage/SKILL.md`, then `malware-dynamic-analysis/SKILL.md` 6. "MS Windows shortcut" (LNK) → read and follow `specialized-file-analyzer/SKILL.md` 7. ASCII text / script content → read and follow `specialized-file-analyzer/SKILL.md` 8. Archive formats (Zip, RAR, 7z) → read and follow `specialized-file-analyzer/SKILL.md` 9. HTML Application (.hta) → read and follow `specialized-file-analyzer/SKILL.md` 10. ISO/IMG disk images → read and follow `specialized-file-analyzer/SKILL.md` (mount/extract, then analyze contents) 11. VHD/VHDX virtual hard disks → read and follow `specialized-file-analyzer/SKILL.md` (mount/extract, then analyze contents) 12. "data" / zero-byte / unrecognized → read and follow `malware-triage/SKILL.md` for manual assessment
**.NET is the key ambiguity:** `file` outputs both "PE32" and "Mono/.Net assembly" for .NET assemblies. Always check for .NET before checking for PE.
Phase Sequence
Each sample follows this sequence:
Triage → [Dynamic Analysis OR Specialized File Analysis] → Detection Engineering → Report Writing
- **Triage** is always first — read and follow `malware-triage/SKILL.md`
- **Dynamic analysis** for PE
Claude skills package for operational malware analysis — covering triage, dynamic analysis, detection engineering, and reporting. Does not cover deep static reverse engineering (e.g., Ghidra/IDA Pro disassembly).
Repo: gl0bal01/malware-analysis-claude-skills