skills.rest
drupadsachania
drupadsachaniaCOMMUNITY
Explore all skills by this author →
GitHub

malware-analysis

Analyze malware samples through a 6-phase workflow from triage to intelligence reporting.

Updated May 22, 2026
Search Tags:#analysis#sandbox#malware#forensics#threat-intelligence#mitre-attack#ioc
One-click install
npx skills add https://github.com/drupadsachania/aegis-skills --skill malware-analysis-drupadsachania
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/drupadsachania/aegis-skills/tree/main/skills/malware-analysis
Command: npx skills add https://github.com/drupadsachania/aegis-skills --skill malware-analysis-drupadsachania

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Automates a structured, phase-driven malware analysis pipeline from triage to intelligence reporting, ensuring consistency and releasable artifacts for security teams.

Core Features & Use Cases

  • 6-phase analysis workflow: sample-triage, static-analysis, dynamic-analysis, memory-analysis, ioc-extraction, intelligence-report.
  • YAML frontmatter metadata defines scope, triggers, and outputs to support discovery and automation.
  • Phase-specific references and artifact generation enable reproducible investigations and collaboration.

Quick Start

Run the malware-analysis skill to begin phase-driven analysis and generate intelligence-ready artifacts.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure an end-to-end malware analysis workflow from triage to intelligence reporting?▼

Malware analysis workflow can be structured using a 6-phase pipeline covering sample triage, static analysis, dynamic analysis, memory analysis, IOC extraction, and intelligence reporting to ensure consistent, releasable artifacts for security teams.

What is MITRE ATT&CK mapping and when do I need it during malware analysis?▼

MITRE ATT&CK mapping is the process of linking malware behaviors to known adversary tactics and techniques, and it is needed during malware analysis to contextualize threats and generate actionable threat intelligence reports.

How do I extract IOCs from malware samples for threat intelligence?▼

IOC extraction involves identifying indicators of compromise such as file hashes, IP addresses, and domains from malware samples, which can be automated as a specific phase within a structured malware analysis pipeline to support intelligence reporting.

Can I use a sandbox environment for dynamic analysis and memory forensics?▼

Sandbox environments are used for dynamic analysis to safely execute malware samples and observe behavior, while memory forensics analyzes the resulting system memory dumps to uncover runtime artifacts and malicious injection techniques.

Does this malware analysis pipeline support security operations centers and threat researchers?▼

This malware analysis pipeline is applicable to security operations centers and threat researchers performing static and dynamic analysis, memory forensics, IOC extraction, and MITRE ATT&CK mapping to ensure reproducible investigations.

What's the best way to generate reproducible artifacts during malware forensics?▼

Reproducible artifacts during malware forensics are generated by implementing a phase-driven analysis workflow with YAML frontmatter metadata and phase-specific references, ensuring consistent collaboration and releasable intelligence outputs.

Related Skills

Explore More Education & Research Skills→
GhostPWNGhostPWN
4

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

Official
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced