Anti Malware

Anti-Malware Defense Skill

Defensive cybersecurity skill for malware detection, analysis, and mitigation. Focuses on legitimate security operations: identifying threats, extracting indicators of compromise, and hardening systems.

Core Capabilities

1. Static Analysis

• File header/magic byte verification
• PE/ELF structure analysis (imports, sections, resources)
• String extraction and entropy analysis
• Packer/crypter detection (UPX, ASPack, custom)
• YARA rule matching and creation
• Hash calculation (MD5, SHA1, SHA256, SSDEEP, TLSH)

2. Dynamic/Behavioral Analysis

• Process monitoring (API calls, registry, filesystem, network)
• Sandbox execution with API hooking (Cuckoo, CAPE, custom)
• Network traffic analysis (PCAP, DNS, HTTP, C2 detection)
• Persistence mechanism identification
• Anti-analysis/anti-VM technique detection

3. Memory Forensics

• Volatility/Volatility3 plugin usage
• Process listing, DLL injection detection
• Rootkit detection (DKOM, SSDT hooks, IDT)
• Encrypted payload extraction
• Shellcode identification

4. Threat Intelligence & IOC

• IOC extraction (IPs, domains, hashes, mutexes, registry keys)
• MITRE ATT&CK technique mapping
• Threat feed integration (MISP, OpenCTI, AlienVault OTX)
• Campaign attribution support

Workflow

1. TRIAGE
   - Hash lookup (VirusTotal, MalwareBazaar, Hybrid Analysis)
   - Quick static properties (file type, architecture, compiler)
   - Entropy/packer check

2. STATIC ANALYSIS
   - Disassembly (IDA, Ghidra, radare2)
   - String/import analysis
   - YARA scanning
   - Configuration extraction

3. DYNAMIC ANALYSIS
   - Sandbox execution
   - Behavioral monitoring
   - Network capture
   - Memory dump acquisition

4. DOCUMENTATION
   - IOC report (STIX/JSON)
   - YARA rules for detection
   - Mitigation recommendations
   - ATT&CK mapping

Tools & References

Primary Tools

• Static: Ghidra, IDA Free, radare2, CFF Explorer, PE-bear, YARA
• Dynamic: Cuckoo Sandbox, CAPE, ANY.RUN, Joe Sandbox, Procmon, Regshot
• Memory: Volatility3, Rekall, WinDbg, GDB
• Network: Wireshark, Zeek, NetworkMiner, Arkime
• Intel: MISP, OpenCTI, YARA-Rules repo, VirusTotal API

Reference Files

• references/yara-rules.md - YARA rule patterns and best practices
• references/mitre-attack.md - ATT&CK technique reference
• references/ioc-formats.md - STIX/JSON IOC templates
• references/packer-signatures.md - Known packer detection patterns

Output Formats

Malware Analysis Report

# Malware Analysis Report: <sample-name>

## Executive Summary
- Classification: <trojan/ransomware/rootkit/botnet/etc>
- Severity: <Critical/High/Medium/Low>
- Confidence: <High/Medium/Low>

## Static Indicators
- File Hash (SHA256): <hash>
- File Type: <PE32/ELF64/Script/etc>
- Architecture: <x86/x64/ARM>
- Packer: <detected or "none">
- Entropy: <value>
- Imports: <suspicious APIs>
- Strings: <relevant IOCs>

## Behavioral Indicators
- Process Injection: <yes/no + technique>
- Persistence: <registry/scheduled task/service/etc>
- Network: <C2 domains/IPs, protocols>
- Filesystem: <dropped files, encryption>
- Anti-Analysis: <VM detection, debugger detection>

## MITRE ATT&CK Mapping
| Technique ID | Technique Name | Observation |
|--------------|----------------|-------------|
| T1055        | Process Injection | ... |
| T1547        | Boot/Logon Autostart | ... |

## IOCs (STIX/JSON)
```json
{
  "indicators": [
    {"type": "file", "value": "<sha256>", "description": "Malware sample"},
    {"type": "domain", "value": "<c2.domain>", "description": "C2 server"}
  ]
}

YARA Detection Rule

rule <malware_family>_<variant> {
    meta:
        description = "<family> variant <variant>"
        author = "analyst"
        date = "YYYY-MM-DD"
        hash = "<sha256>"
    strings:
        $s1 = "<unique_string>" ascii wide
        $s2 = { <hex_pattern> }
    condition:
        any of them
}

Mitigation Recommendations

1. Block IOCs at perimeter (firewall, proxy, DNS)
2. Deploy YARA rule to EDR/XDR
3. Hunt for behavioral indicators in environment
4. Patch exploited vulnerabilities
5. User awareness for delivery vector

## Trigger Phrases
Use this skill when user mentions:
- "analyze this suspicious file"
- "malware analysis" / "malware detection"
- "create YARA rule" / "YARA signature"
- "threat hunting" / "IOC extraction"
- "sandbox analysis" / "dynamic analysis"
- "memory forensics" / "volatility"
- "reverse engineering malware"
- "antivirus evasion detection"
- "packer detection"
- "C2 communication analysis"
- "ransomware analysis"
- "process injection detection"
- "rootkit detection"