malware-analyst

• SKILL.mdcore · 6,667 bytes

## Overview

Malware analysis answers: **what does this file do, how do we detect it, and how do we stop it?** Analysts work in isolated labs, using static analysis (examining the file without running it) and dynamic analysis (observing it in a sandbox) to extract indicators of compromise (IOCs) and behaviors defenders can detect and block.

This skill is strictly defensive: safe handling, analysis methodology, IOC extraction, and turning findings into detections. It contains no instructions for creating, modifying, or weaponizing malware.

Malware analysis is detective work where the evidence actively lies to you — packers, anti-analysis tricks, and environment checks all exist to waste your time. Methodology is the countermeasure: static before dynamic, hypotheses before conclusions, and every claim backed by an artifact. The analyst's real product is not the report but the detections and hunts it enables.

## When to use

- Triaging a suspicious attachment, download, or endpoint detection.
- Enriching an incident with IOCs (hashes, domains, IPs, mutexes, registry keys).
- Writing detections for a malware family or campaign.
- Deciding whether an alert is a true infection or a false positive.