skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

performing-malware-ioc-extraction

Extract file hashes, IPs, domains, URLs, and registry modifications from malware samples.

Updated Apr 23, 2026
Search Tags:#malware#incident-response#threat-intelligence#ioc#yara#stix#pe-analysis
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-malware-ioc-extraction
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-malware-ioc-extraction
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-malware-ioc-extraction
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-malware-ioc-extraction

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Malware IOC extraction automates the identification of indicators of compromise from malicious software, enabling faster threat hunting and response.

Core Features & Use Cases

  • Static analysis: PE parsing, hash generation, string extraction to identify IOCs
  • YARA-based classification and STIX 2.1 indicator creation for sharing across TI platforms
  • Use Case: Analysts run the tool on a sample to produce a structured IOC bundle and human-readable report for incident response

Quick Start

Run the tool against a malware sample to extract IOCs and generate a STIX bundle.

Frequently Asked Questions about performing-malware-ioc-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract IOCs from a malware sample for incident response?▼

Extracting IOCs from a malware sample involves static analysis, PE parsing, and string extraction to identify file hashes, IPs, domains, URLs, registry modifications, and mutex names. This process generates a structured IOC bundle and a human-readable report for incident response.

What is the best way to classify malware samples using YARA rules?▼

YARA-based classification matches malware samples against defined rule patterns to identify malicious families. This approach automates the identification of indicators of compromise, enabling faster threat hunting and response during investigations.

How do I generate a STIX 2.1 bundle from extracted indicators of compromise?▼

STIX 2.1 indicator bundle creation formats extracted IOCs like file hashes, IPs, and domains into a standardized structure for sharing. This enables seamless integration and distribution across threat intelligence platforms.

Can I parse PE files to find registry modifications and mutex names?▼

PE parsing analyzes portable executable files to extract actionable indicators of compromise including registry modifications and mutex names. It supports static analysis to identify malicious behaviors within the sample structure.

Does malware IOC extraction require any external dependencies or tools?▼

Malware IOC extraction operates without external dependencies, running scripts directly against provided samples. It supports static analysis, YARA-based classification, and STIX 2.1 creation independently for security analysts.

What specific IOC types can I extract during static malware analysis?▼

Static malware analysis extracts actionable indicators of compromise such as file hashes, IPs, domains, URLs, registry modifications, and mutex names. These IOCs support threat hunting and intelligence enrichment workflows.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

reverse-engineering-rust-malware

Identify Rust-compiled malware binaries and extract crate dependencies and suspicious patterns.

Community
Advanced
Liberty91LTDLiberty91LTD
15

stix-bundle

Generate STIX 2.1 bundles modeling threat intelligence objects and relationships.

Official
Advanced
langbyyilangbyyi
96

ctf-malware

Analyze obfuscated malware and decrypt C2 traffic for CTF challenges.

Community
Advanced
gl0bal01gl0bal01
44

malware-dynamic-analysis

Execute malware samples in sandboxes and capture runtime behavior with monitoring tools.

Community
Advanced