skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

malware-analysis

Automates end-to-end malware analysis to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings.

21|1|Updated Apr 12, 2026
Search Tags:#incident-response#mitre-attack#malware-analysis#sigma#yara#ioc-generation
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill malware-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/woohyun212/security-skill/tree/main/malware-analysis
Command: npx skills add https://github.com/woohyun212/security-skill --skill malware-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzes suspicious files end-to-end to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings for faster incident response and threat intelligence.

Core Features & Use Cases

  • Five-phase malware analysis pipeline (triage, static, dynamic, code, classification)
  • Produces structured reports with IOCs, detection rules, and remediation guidance
  • Applicable to incident response, threat intel, and malware investigations to map samples to families and attack techniques

Quick Start

Provide the path to a suspicious file to run the end-to-end malware analysis pipeline and generate a comprehensive report.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate malware analysis to generate YARA and Sigma rules?▼

You can automate malware analysis by providing a suspicious file path to run an end-to-end pipeline that generates IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings. The pipeline executes triage, static, dynamic, and code analysis phases to produce structured detection rules.

How do I map suspicious binary behaviors to MITRE ATT&CK techniques?▼

Mapping suspicious binary behaviors to MITRE ATT&CK techniques is achieved through an automated five-phase analysis pipeline. This process analyzes suspicious binaries, documents, or scripts and maps observed behaviors directly to known malware families and specific ATT&CK techniques.

Do I need a VirusTotal API key to perform incident response malware analysis?▼

A VirusTotal API key is not strictly required for local malware analysis but is used as an optional environment variable (VT_API_KEY) for VirusTotal integration. Core analysis relies on Linux utilities, Python with yara-python, FLOSS, DIE, and oletools.

What is the best way to extract IOCs from suspicious documents for threat intelligence?▼

The best way to extract IOCs from suspicious documents is using an automated malware analysis workflow that utilizes tools like oletools and FLOSS. This process extracts indicators of compromise and produces a structured report for threat intelligence and incident response.

Can I use Ghidra or IDA for code analysis within an automated malware analysis workflow?▼

Yes, Ghidra or IDA can be used optionally for the code analysis phase within the malware analysis workflow. The pipeline integrates these reverse engineering tools alongside static and dynamic analysis to produce comprehensive IOCs and MITRE ATT&CK mappings.

What Linux utilities are required to run an end-to-end malware analysis pipeline?▼

Running an end-to-end malware analysis pipeline requires Linux utilities like file, sha256sum, and strings, alongside Python with yara-python, FLOSS, DIE, and oletools. These tools perform triage, static, dynamic, and code analysis to generate structured reports.

Related Skills

Explore More Education & Research Skills→
SherifEldeebSherifEldeeb
5

malware-forensics

Analyze malware samples to produce forensic insights and IOC lists.

Community
Advanced
copyleftdevcopyleftdev

roth-detection-engineering

Create portable YARA and Sigma threat detection rules for malware hunting.

Community
Intermediate
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced
WPeace-HcHWPeace-HcH
88

wpegpt-analyzer

Automate reverse analysis of PE and ELF binaries via IDA WPeGPT producing structured reports.

Community
Advanced