skills.rest
Q16G
Q16GCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

malware-detect

Identify and analyze potential malware on a host using YARA rules and forensic checks.

83|8|Updated May 6, 2026
Search Tags:#forensics#incident-response#process-analysis#threat-hunting#malware-detection#yara#host-analysis
One-click install
npx skills add https://github.com/Q16G/aster --skill malware-detect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-detect
Source: https://github.com/Q16G/aster/tree/main/skills/host-defense/malware-detect
Command: npx skills add https://github.com/Q16G/aster --skill malware-detect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies and analyzes potential malware on a host by evaluating suspicious files and running processes with YARA rules and forensic checks.

Core Features & Use Cases

  • Process and file analysis: Inspect running processes and files for signs of malware, including suspicious process names, unusual parent-child relationships, and high resource usage.
  • Hash and string analysis: Compute file hashes, compare against known malicious hashes, extract readable strings for indicators, and perform YARA scans.
  • Persistence and network checks: Inspect for persistence mechanisms (cron/systemd, rc.local), unusual network activity, and potential rootkits.
  • Use Case: A SOC analyst can run this skill against a host to surface suspected malware and generate a forensics-ready report.

Quick Start

Run malware-detect against a target path to scan files and processes for indicators of compromise.

Frequently Asked Questions about malware-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect malware on a host using YARA rules and forensic checks?▼

To detect malware on a host, you can scan suspicious files and running processes using YARA rules alongside forensic checks. This evaluates process relationships, file hashes, and persistence mechanisms to identify indicators of compromise.

Can I scan running processes for suspicious parent-child relationships during incident response?▼

Yes, you can scan running processes for suspicious parent-child relationships during incident response. The analysis inspects process names, unusual hierarchies, and high resource usage to surface potential malicious activity on the target host.

Does host malware detection work across Linux, macOS, and Windows environments?▼

Yes, host malware detection works across Linux, macOS, and Windows environments. It performs on-demand endpoint triage by evaluating platform-specific persistence mechanisms like cron, systemd, and rc.local to identify threats.

Do I need a VirusTotal API key to analyze file hashes for potential threats?▼

You do not strictly need a VirusTotal API key to analyze file hashes, as local hash databases can also verify indicators. However, integrating VirusTotal or local databases is an optional capability to help confirm known malicious hashes.

What is the best way to check for persistence mechanisms like cron and systemd during threat hunting?▼

The best way to check for persistence mechanisms like cron and systemd during threat hunting is to run a dedicated forensic analysis. This inspects startup scripts, scheduled tasks, and unusual network activity to identify rootkits and persistent threats.

Related Skills

Explore More Software Engineering Skills→
manuelbrandner85manuelbrandner85

yara-rule-authoring

Author and optimize YARA-X detection rules for malware identification.

Community
Advanced
jaskaranhundaljaskaranhundal
3

forensics

Reconstruct digital forensics timelines and extract Indicators of Compromise.

Community
Advanced
mikopbxmikopbx
569

container-inspector

Retrieve MikoPBX Docker container IPs, ports, and API URLs.

Official
Advanced
daffy0208daffy0208
34

forensic-data-engineer

Detect data anomalies and fraud in audit trails and logs.

Community
Advanced