skills.rest
gl0bal01gl0bal01Community·5 Agent Skills Included

malware-analysis-claude-skills

Malware triage, sandbox analysis, detection rules, and reporting

Guides the full malware analysis lifecycle from sample triage and safe sandbox execution to detection rule creation and professional report writing. Covers PE executables, Office macros, PDFs, scripts, archives, and disk images with step-by-step tool workflows for Procmon, Wireshark, and Sysmon. Eliminates guesswork by routing each file type to the right analysis method and producing tested Sigma, Suricata, and YARA rules.
44|3
↗
npx skills add gl0bal01/malware-analysis-claude-skills --all -g -y
Available:

Tells the agent how the orchestrator routes samples to the five sub-skills by file type, enforces conventions like IOC defanging and hash reporting, and keeps analysis evidence in text formats.

All Skills in This Repository (5)

Pure Emerald Level Indicators
📦 In Repo
gl0bal01gl0bal01

malware-report-writer

Generate structured malware analysis reports with IOCs and detection rules.

Community
Intermediate
📦 In Repo
gl0bal01gl0bal01

specialized-file-analyzer

Analyze specialized file formats and extract embedded payloads and IOCs.

Community
Intermediate
📦 In Repo
gl0bal01gl0bal01

malware-dynamic-analysis

Execute malware samples in sandboxes and capture runtime behavior with monitoring tools.

Community
Advanced
📦 In Repo
gl0bal01gl0bal01

detection-engineer

Convert malware analysis findings into Sigma and Suricata detection rules.

Community
Advanced
📦 In Repo
gl0bal01gl0bal01

malware-triage

Triage malware samples to assess threat level and prioritize analysis.

Community
Advanced

Frequently Asked Questions

FAQPage Schema
How to install malware-analysis-claude-skills?▼

Run `npx skills add gl0bal01/malware-analysis-claude-skills --all -g -y` in your terminal to install the orchestrator and all five sub-skills globally.

How to analyze a suspicious file safely?▼

Describe the file to the orchestrator and it routes you through triage first, then guides safe execution in an isolated REMnux or FlareVM virtual machine. The agent never runs malware directly — it analyzes exported evidence like Procmon logs and network captures.

Can it analyze Office documents and PDFs?▼

Yes. The specialized file analyzer covers Office macros, PDFs, PowerShell and VBScript, archives, shortcuts, disk images, and Linux binaries with dedicated deobfuscation and extraction workflows.

Does it create detection rules for my SIEM?▼

Yes. It generates tested Sigma rules for SIEM platforms, Suricata rules for network detection, YARA rules for file scanning, and hunting queries for Splunk and Elastic.

Do I need malware analysis experience to use it?▼

No. The orchestrator handles routing, checklists, and report structure automatically, so you just describe your sample and follow the guided steps.

Related Repositories in Software Engineering

View All in Software Engineering→
openclawopenclaw
388.4k

openclaw

Run a personal AI assistant across your devices and chat apps

Official📦 120 Skills
obraobra
280.0k

superpowers

Gives coding agents a disciplined workflow from idea to merged code

Community📦 15 Skills
facebookfacebook
248.4k

react

AI agent skills for building, testing, and porting React core

Official📦 14 Skills