malware-analysis

Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill malware-analysis

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

14 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Malware Analysis

When to Activate

Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.

Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).

Detonating safely and recovering fileless / in-memory artifacts (injection, AMSI/ETW patching, WMI persistence).

Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.

Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).

Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies

T1027

CWE-506

references/static-triage-capa.md

scripts/triage.py

Per-section entropy + packer/RWX/EP heuristics

T1027.002

CWE-1066

references/static-triage-capa.md

scripts/triage.py

Obfuscated string recovery (FLOSS)

T1140, T1027.013

CWE-656

references/static-triage-capa.md

scripts/triage.py

Capability detection → ATT&CK (capa, static+dynamic)

T1027

CWE-506

references/static-triage-capa.md

scripts/triage.py

Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling)

T1140, T1620

CWE-656

references/unpacking-deobfuscation.md

scripts/auto_unpack.py

DBI unpacking via API hooks (Frida)

T1055, T1620

CWE-656

references/unpacking-deobfuscation.md

scripts/frida_unpack.js

.NET deobfuscation/unpacking (de4dot/dnSpyEx)

T1027, T1140

CWE-656

references/unpacking-deobfuscation.md

scripts/frida_unpack.js

Sandbox detonation + behavioral capture

T1497

CWE-506

references/dynamic-fileless-memory.md

scripts/mem_triage.py

Memory injection/hollowing/ghosting analysis (Vol3)

T1055, T1055.012

Malware Analysis

When to Activate

Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.

Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).

Detonating safely and recovering fileless / in-memory artifacts (injection, AMSI/ETW patching, WMI persistence).

Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.

Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).

Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies

T1027

CWE-506

references/static-triage-capa.md

scripts/triage.py

Per-section entropy + packer/RWX/EP heuristics

T1027.002

CWE-1066

references/static-triage-capa.md

scripts/triage.py

Obfuscated string recovery (FLOSS)

T1140, T1027.013

CWE-656

references/static-triage-capa.md

scripts/triage.py

Capability detection → ATT&CK (capa, static+dynamic)

T1027

CWE-506

references/static-triage-capa.md

scripts/triage.py

Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling)

T1140, T1620

CWE-656

references/unpacking-deobfuscation.md

scripts/auto_unpack.py

DBI unpacking via API hooks (Frida)

T1055, T1620

CWE-656

references/unpacking-deobfuscation.md

scripts/frida_unpack.js

.NET deobfuscation/unpacking (de4dot/dnSpyEx)

T1027, T1140

CWE-656

references/unpacking-deobfuscation.md

scripts/frida_unpack.js

Sandbox detonation + behavioral capture

T1497

CWE-506

references/dynamic-fileless-memory.md

scripts/mem_triage.py

Memory injection/hollowing/ghosting analysis (Vol3)

T1055, T1055.012

name	malware-analysis
description	Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)
metadata	{"type":"defensive","phase":"analysis","tools":"capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata","mitre":"TA0042"}
kill_chain	{"phase":["weaponize"],"step":[2],"attck_tactics":["TA0042","TA0005","TA0011"],"attck_techniques":["T1027","T1027.002","T1027.013","T1140","T1055","T1055.012","T1620","T1562.001","T1497","T1547.001","T1546.003","T1059.001","T1071.001","T1071.004","T1573","T1572","T1568.002","T1480"]}
depends_on	["reverse-engineering"]
feeds_into	["threat-hunting","incident-response","edr-evasion","network-attack"]
inputs	["malware_sample","memory_image","pcap_capture","sandbox_report"]
outputs	["yara_rules","ioc_list","behavioral_report","malware_config","capability_map","c2_indicators"]
references	["references/static-triage-capa.md","references/unpacking-deobfuscation.md","references/dynamic-fileless-memory.md","references/config-c2-extraction.md","references/network-c2-detection.md","references/yara-detection-engineering.md"]
scripts	["scripts/triage.py","scripts/auto_unpack.py","scripts/frida_unpack.js","scripts/cs_config_extract.py","scripts/mem_triage.py","scripts/beacon_profiler.py","scripts/yara_gen.py"]

name	malware-analysis
description	Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)
metadata	{"type":"defensive","phase":"analysis","tools":"capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata","mitre":"TA0042"}
kill_chain	{"phase":["weaponize"],"step":[2],"attck_tactics":["TA0042","TA0005","TA0011"],"attck_techniques":["T1027","T1027.002","T1027.013","T1140","T1055","T1055.012","T1620","T1562.001","T1497","T1547.001","T1546.003","T1059.001","T1071.001","T1071.004","T1573","T1572","T1568.002","T1480"]}
depends_on	["reverse-engineering"]
feeds_into	["threat-hunting","incident-response","edr-evasion","network-attack"]
inputs	["malware_sample","memory_image","pcap_capture","sandbox_report"]
outputs	["yara_rules","ioc_list","behavioral_report","malware_config","capability_map","c2_indicators"]
references	["references/static-triage-capa.md","references/unpacking-deobfuscation.md","references/dynamic-fileless-memory.md","references/config-c2-extraction.md","references/network-c2-detection.md","references/yara-detection-engineering.md"]
scripts	["scripts/triage.py","scripts/auto_unpack.py","scripts/frida_unpack.js","scripts/cs_config_extract.py","scripts/mem_triage.py","scripts/beacon_profiler.py","scripts/yara_gen.py"]

Technique	Telemetry/IOC	Detection (Sigma/EDR)	OPSEC note
Static triage	None (offline)	n/a — feeds YARA/imphash hunting	Read-only, no execution; isolate sample dir
Emulation unpack	None (no detonation)	n/a	Preferred first pass; safe, no network
DBI/manual unpack	Sysmon 8/10 (CallTrace UNKNOWN), RWX commit	EDR memory scan; RWX-then-exec Sigma	DETONATES — isolated VM, snapshot, FakeNet; loaders self-delete, dump first
Injection/hollowing	malfind/hollowprocesses; EID 8/10	Vol3 hollow/ghosting/pebmasquerade; CreateRemoteThread	Capture memory pre-remediation
AMSI/ETW patch	amsi.dll load + patched prologue; B8 00..C3 stub	Sigma T1562.001; debug-reg+VEH for patchless	Patchless evades byte scans — watch Dr0-Dr7
Fileless persistence	WMI consumers; PS 4104; Run-key blobs	Vol3 registry/wmi; Sysmon 13/22	Lives in WMI/registry/memory — no disk file
Config extraction	C2 host/UA/pipe/watermark	YARA config table; Suricata on C2 URI/SNI	Offline; handle watermark/keys per ROE
Beacon detection	Periodic outbound deltas	beacon_profiler CV score; Suricata threshold	Passive on captured traffic
JA4+ fingerprint	JA4/JA4S/JA4X/JA4H tuples	Zeek ja4 watchlist (Sliver/Havoc JA4X)	JA4X needs TLS1.3 cert visibility at proxy
YARA-X authoring	None	The rules themselves	Validate 0-FP on goodware before deploy

malware-analysis

Install options

Review the source files