skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

malware-analysis

Analyze suspicious binary files with static and dynamic analysis, YARA rules, and MITRE ATT&CK mapping.

Updated Jul 1, 2026
Search Tags:#binary analysis#sandboxing#MITRE ATT&CK#malware analysis#YARA rules
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill malware-analysis-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/malware-analysis
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill malware-analysis-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a methodology for analyzing suspicious binaries, focusing on unpacking, analysis, behavioral sandboxing, network signature generation, YARA rule creation, and MITRE ATT&CK mapping. It helps in identifying indicators of compromise (IOCs) and capabilities within malware samples.

Core Features & Use Cases

  • Static Analysis: Identify packers, imports, and analyze file formats like PE, ELF, Mach-O.
  • Dynamic Analysis: Capture network traffic and system calls during execution.
  • YARA Rule Generation: Create rules for detecting specific malware patterns.
  • MITRE ATT&CK Mapping: Classify behaviors against MITRE's framework.

Quick Start

Analyze a binary file named 'malware_sample.bin' for signs of suspicious behavior and network communications.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a suspicious binary file for malware indicators?▼

Analyzing a suspicious binary file for malware involves executing static and dynamic analysis to identify packers, imports, and system calls. This process helps uncover indicators of compromise and map malicious behaviors to the MITRE ATT&CK framework.

How do I generate YARA rules for detecting specific malware patterns?▼

Generating YARA rules for malware detection is achieved by analyzing suspicious binaries to identify unique patterns and capabilities. The Skill creates these rules to detect specific malware signatures based on the static and dynamic analysis results.

Does this malware analysis approach support multiple executable formats like PE, ELF, and Mach-O?▼

Yes, malware analysis supports identifying packers and imports across multiple executable file formats. It specifically analyzes PE, ELF, and Mach-O files during static analysis to detect suspicious behavior and network communications.

How do I map suspicious binary behaviors to the MITRE ATT&CK framework?▼

Mapping suspicious binary behaviors to the MITRE ATT&CK framework is done by classifying the capabilities observed during dynamic analysis and sandboxing. This identifies specific tactics and techniques used by the malware sample.

Can I capture network traffic and system calls during dynamic malware analysis?▼

Yes, dynamic malware analysis captures network traffic and system calls during binary execution. This behavioral sandboxing approach helps identify active network communications and indicators of compromise within the malware sample.

What is the best way to identify packers and imports in suspicious binaries?▼

The best way to identify packers and imports in suspicious binaries is through static analysis. This methodology examines file formats like PE, ELF, and Mach-O without execution to safely unpack and analyze the malware sample.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

malware-triage

Perform static analysis on PE, ELF, Mach-O, and script samples to generate indicators of compromise.

Community
Advanced
riparinoriparino
1

defensive-rce

Correlate web process spawning and command injection signals to detect RCE attempts.

Community
Advanced
msandbumsandbu
2

ioc-investigation

Investigate IP addresses, domains, URLs, and file hashes with threat intelligence correlation.

Community
Advanced
JameZUKJameZUK
39

arkana-analyze

Analyze malware binaries with Arkana to produce structured digests and IOCs.

Community
Advanced