skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

malware-analysis

Analyzes malware samples through static, dynamic, and behavioral phases to produce YARA rules, Sigma detections, and IOCs.

7|4|Updated Jun 22, 2026
Search Tags:#sandbox#reverse engineering#threat intelligence#sigma#yara#malware analysis#ioc extraction
One-click install
npx skills add https://github.com/dbx0/skills --skill malware-analysis-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/dbx0/skills/tree/main/skills/malware-c2/analysis/malware-analysis
Command: npx skills add https://github.com/dbx0/skills --skill malware-analysis-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara-python, flare-floss, and includes references (resource) components.

What problem does it solve? Triaging a suspicious binary, document, or script requires coordinating many tools and techniques, and analysts often miss anti-analysis tricks or produce detection rules with high false-positive rates. This Skill provides a structured six-phase workflow covering triage, static analysis, sandbox detonation, YARA and Sigma rule authoring, and IOC extraction. ## Core Features & Use Cases - Six-Phase Analysis Workflow: Guides initial triage (file type, strings, hashes), static analysis (Ghidra, IDA, radare2), sandbox dynamic analysis (CAPE, ANY.RUN, Triage), YARA rule authoring, Sigma rule generation, and IOC extraction. - Anti-Analysis Detection Reference: Documents 94 anti-analysis techniques across 9 categories (timing, CPU, firmware, hardware, API hooks, process, filesystem, registry, window detection) with validated YARA rules and precision ratings. - Sandbox Orchestration: Provides CAPE deployment steps, multi-sandbox chained pipeline code, ASD Azul integration, and automated IOC extraction logic. - Use Case: Given a suspicious PE file from a phishing campaign, follow the workflow to fingerprint the packer, detonate it in CAPE, extract C2 domains and mutexes, then author a YARA rule for endpoint detection and a Sigma rule for SIEM alerting. ## Quick Start Analyze the attached suspicious executable sample and produce a triage report with extracted IOCs and a draft YARA detection rule.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a suspicious malware sample step by step?▼

Start with triage using file, strings, and hash lookups against VirusTotal or MalwareBazaar. Then perform static analysis in Ghidra or radare2, detonate the sample in a sandbox like CAPE, and finish by extracting IOCs and writing YARA and Sigma detection rules.

How do I write a YARA rule to detect a malware family?▼

Define meta fields, string patterns (ASCII, hex, or regex), and a condition combining them, typically anchored with uint16(0) == 0x5A4D for PE files. Validate the rule with yara -C against known samples and a benign set to control false positives.

Which sandbox should I use for malware detonation?▼

CAPE v2 is recommended for deep open-source analysis with YARA integration and anti-evasion options. ANY.RUN suits interactive rapid triage, Triage handles fast batch pre-screening, and Joe Sandbox offers the strongest evasion detection for high-value samples.

How do I detect anti-analysis techniques like VM or debugger checks?▼

Look for SMBIOS strings like VMware or VirtualBox, MAC OUIs such as 00:0C:29, sandbox file paths, and PEB.BeingDebugged access patterns. Firmware, filesystem, registry, and window detection categories yield the highest YARA precision, around 76 to 87 percent.

What is the difference between YARA and Sigma rules?▼

YARA rules match patterns inside files or memory for endpoint and sample detection. Sigma rules describe behavioral log detections, such as suspicious process creation events, and compile to SIEM queries like Splunk SPL or Elasticsearch.

Why does malware not execute in my sandbox?▼

The sample likely uses evasion such as long Sleep calls, disk size checks, user interaction detection, or VM fingerprinting. Enable CAPE anti-evasion options like sleep skipping, simulated human interaction, and extended timeouts to counter these techniques.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

analyzing-indicators-of-compromise

Enriches IOCs with multi-source threat intelligence to assign confidence scores and blocking dispositions.

Community
Intermediate
yogiexyogiex

threat-intelligence

Guides CTI lifecycle, IOC management, and threat hunting using STIX, MISP, and ATT&CK frameworks.

Community
Intermediate
AgentSecOpsAgentSecOps
183

analysis-tshark

Analyze network traffic and protocol behavior with Tshark for security investigations.

Official
Advanced
xalgordxalgord
954

building-automated-malware-submission-pipeline

Automates malware sample collection, sandbox submission, verdict generation, and SIEM IOC integration.

Community
Advanced