skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

malware-forensics

Analyze malware samples to produce forensic insights and IOC lists.

5|Updated Jan 12, 2026
Search Tags:#analysis#malware#forensics#incident-response#IOCs#YARA#PE
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill malware-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/malware-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill malware-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps incident responders and threat analysts by automating malware analysis to identify indicators of compromise, understand capabilities, and document findings for response and threat intelligence.

Core Features & Use Cases

  • Static and dynamic malware analysis to extract IOCs, behaviors, and attribution data.
  • PE analysis for Windows executables, DLLs, and drivers, plus document analysis for malicious Office documents and PDFs.
  • YARA scanning, string analysis, and unpacking support to classify and triage samples.
  • Use Case: During a breach, run malware analysis to produce an IR report and threat intel enrichment.

Quick Start

Use the malware-forensics skill to analyze a sample and generate an IOC report.

Frequently Asked Questions about malware-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate malware analysis to extract IOCs during incident response?▼

You can automate malware forensics to extract IOCs by applying static and dynamic analysis across executables, scripts, and documents. This process yields forensic insights and IOC lists to support incident response and threat intelligence.

What is the best way to analyze malicious Office documents and PE files for threat intelligence?▼

Analyzing malicious Office documents and PE files involves applying static and dynamic techniques to identify behaviors and indicators of compromise. The process extracts capabilities and attribution data to produce an IR report and threat intel enrichment.

Do I need Python tooling and YARA support to perform malware forensics?▼

Yes, malware forensics requires Python tooling with optional YARA, PE, and oletools support. These dependencies enable string analysis, unpacking support, and document analysis to classify and triage malware samples effectively.

Can I use this approach for both static and dynamic analysis of Windows executables and DLLs?▼

Yes, you can use malware forensics for both static and dynamic analysis of Windows executables, DLLs, and drivers. PE analysis helps understand capabilities, while dynamic analysis extracts behaviors for incident response documentation.

How does YARA scanning and string analysis help classify malware samples?▼

YARA scanning and string analysis classify and triage malware samples by identifying specific patterns and indicators within executables, scripts, or documents. This classification supports threat intelligence and helps document findings for incident response.

Related Skills

Explore More Data & Analytics Skills→
woohyun212woohyun212
21

malware-analysis

Automates end-to-end malware analysis to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings.

Community
Advanced
jassicsjassics
6

ioc-development

Extract and validate atomic, computed, and behavioral indicators from incident data.

Community
Advanced
wgpsecwgpsec
1.6k

ctf-malware

Analyzes CTF Windows malware samples to reveal hidden C2 infrastructure and decrypt payloads via static and dynamic methods.

Official
Advanced
chicanoandres702chicanoandres702

malware-analyst

Analyze malware samples for triage, static and dynamic analysis, and IOC extraction.

Community
Advanced