Verified:GitHub

Skill: Malware Analysis (Static / Capability)

Extract static evidence and map malware capabilities to ATT&CK techniques.

1|Updated Apr 25, 2026

Search Tags:#malware analysis #ioc extraction #att&ck mapping #static triage #capability profiling #yara hunting #entropy detection

Ready to run

npx skills add https://github.com/rjonhaas/SIFTics --skill skill-malware-analysis-static-capability

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Skill: Malware Analysis (Static / Capability)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/malware-analysis
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill skill-malware-analysis-static-capability

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires file, exiftool, md5sum, sha256sum, ssdeep, strings, capa, binwalk, upx, objdump, readelf, yara, hexdump, xxd, grep, awk, python3.

What problem does it solve?

It reduces analyst uncertainty by turning raw, suspicious binaries/scripts/dumps into a structured capability profile that answers what the artifact does and how it behaves.

Core Features & Use Cases

Static identification & hashing: Extract file type, metadata, and multiple hashes for IOC logging and similarity matching.
Packing/entropy & unpacking loop: Detect likely packing/obfuscation (e.g., UPX) and re-run analysis on unpacked payloads.
Capability discovery with ATT&CK mapping: Use capa plus import-category heuristics to build an operational capability summary and pivot to next steps.

Quick Start

Use this skill to analyze the suspicious file 'sample.bin' end-to-end, producing file type, hashes, strings-derived IOCs, packing status, and an ATT&CK-oriented capability profile.

Frequently Asked Questions about Skill: Malware Analysis (Static / Capability)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform static malware analysis on a suspicious executable file?▼

Static malware analysis identifies file types, extracts metadata and hashes, checks entropy and packing status, and maps capabilities to ATT&CK techniques to profile suspicious executable behavior.

How do I extract IOCs and derive a capability profile from an unknown binary?▼

IOC extraction and capability profiling derive hashes, strings, and import heuristics from unknown binaries using capa to produce an ATT&CK-oriented output for escalation and pivoting.

What is the best way to detect packing or obfuscation in a suspicious file?▼

Detecting packing or obfuscation involves calculating file entropy and identifying packers like UPX, optionally unpacking payloads to re-run static analysis on the original binary.

Can I use capa and yara to map malware capabilities to MITRE ATT&CK techniques?▼

Capa and yara map malware capabilities to MITRE ATT&CK techniques by matching static code features and string signatures against known adversary tactics, techniques, and procedures.

Does static triage require unpacking UPX-packed binaries before running strings?▼

Static triage detects UPX packing via entropy checks and unpacks binaries before running strings and capa, ensuring capability extraction targets unpacked payloads rather than obfuscated wrappers.

What tools are needed for DFIR triage and static capability profiling of scripts?▼

DFIR triage and capability profiling of scripts require file, exiftool, md5sum, sha256sum, strings, capa, binwalk, and yara to extract metadata, hashes, and static evidence.