skills.rest
Xerrion
XerrionCOMMUNITY
Explore all skills by this author →
Website𝕏@TheRealXerrionGitHub

rev-malware

Extract IoCs, map MITRE ATT&CK, and author YARA/Sigma rules.

Updated Mar 5, 2026
Search Tags:#reporting#triage#malware#ioc#sigma#yara#mitre
One-click install
npx skills add https://github.com/Xerrion/opencode --skill rev-malware
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rev-malware
Source: https://github.com/Xerrion/opencode/tree/main/skills/rev-malware
Command: npx skills add https://github.com/Xerrion/opencode --skill rev-malware

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Malware triage and authoring tasks demand a disciplined, repeatable workflow to analyze suspected or confirmed malware, extract IoCs, map to MITRE ATT&CK, and craft YARA/Sigma rules with safe handling.

Core Features & Use Cases

  • IoC extraction and structure
  • YARA rule authoring with full meta blocks and testing against samples
  • Sigma rule generation with ATT&CK tags and UUIDs
  • Safe sample handling, sandboxed execution guidance, and evidence-backed reporting
  • MITRE ATT&CK mapping and family identification for threat intel workflows
  • Output artifact generation including structured reports and templates

Quick Start

Initiate a malware triage session on a suspected sample to extract IoCs, author YARA and Sigma rules, and generate a structured report.

Frequently Asked Questions about rev-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract IoCs and map malware samples to MITRE ATT&CK?▼

Malware triage involves analyzing samples to extract IoCs and map behaviors to MITRE ATT&CK. This requires strict sandbox defaults and adherence to an IoC schema for evidence-backed reporting and family identification.

What is the best way to author YARA and Sigma rules for threat intelligence?▼

Authoring YARA and Sigma rules requires generating full meta blocks with ATT&CK tags and UUIDs. YARA rules can be tested against samples, while Sigma rules standardize detection logic for threat intelligence workflows.

How does safe malware sample handling work during analysis?▼

Safe malware handling works by enforcing strict sandbox defaults during analysis. This ensures suspected or confirmed malware is triaged securely, preventing accidental execution while extracting IoCs and generating reports.

How do I generate structured reports for malware triage?▼

Structured reports are generated by compiling extracted IoCs, MITRE ATT&CK mappings, and authored YARA/Sigma rules into output artifacts. This provides evidence-backed documentation for threat intel workflows.

Can I identify malware families using IoC extraction and MITRE mapping?▼

Yes, malware family identification is achieved by combining IoC extraction with MITRE ATT&CK mapping. This process analyzes sample behaviors and indicators to determine the suspected malware family for threat intelligence.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

re-malware-sandbox

Orchestrate isolated malware detonation with network sinkholing and behavioral monitoring.

Community
Advanced
woohyun212woohyun212
21

malware-analysis

Automates end-to-end malware analysis to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings.

Community
Advanced
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced
hypnguyen1209hypnguyen1209
338

reverse-engineering

Reverse-engineer binaries and firmware through static and dynamic analysis.

Community
Advanced