building-automated-malware-submission-pipeline

name	building-automated-malware-submission-pipeline
description	Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","malware-analysis","sandbox","automation","virustotal","cuckoo","any-run","pipeline"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building Automated Malware Submission Pipeline

When to Use

Use this skill when:

• SOC teams face high volume of suspicious file alerts requiring sandbox analysis
• Manual sandbox submission creates bottlenecks in alert triage workflow
• Endpoint and email security tools quarantine files needing automated verdict determination
• Incident response requires rapid malware family identification and IOC extraction

Do not use for analyzing live malware samples in production environments — always use isolated sandbox infrastructure.

Prerequisites

• Sandbox environment: Cuckoo Sandbox, Joe Sandbox, Any.Run, or VMRay
• VirusTotal API key (Enterprise for submission, free for lookup)
• MalwareBazaar API access for known malware lookup
• File collection mechanism: EDR quarantine API, email gateway export, network capture
• Python 3.8+ with requests, vt-py, pefile libraries
• Isolated analysis network with no production connectivity

Workflow

Step 1: Build File Collection Pipeline

Collect suspicious files from multiple sources:

import requests
import hashlib
import os
from pathlib import Path
from datetime import datetime

class MalwareCollector:
    def __init__(self, quarantine_dir="/opt/malware_quarantine"):
        self.quarantine_dir = Path(quarantine_dir)
        self.quarantine_dir.mkdir(exist_ok=True)

    def collect_from_edr(self, edr_api_url, api_token):
        """Pull quarantined files from CrowdStrike Falcon"""
        headers = {"Authorization": f"Bearer {api_token}"}

        
        response = requests.get(
            ,
            headers=headers,
            params={: , : }
        )
        file_ids = response.json()[]

         file_id  file_ids:
            
            dl_response = requests.get(
                ,
                headers=headers,
                params={: file_id}
            )
            file_data = dl_response.content
            sha256 = hashlib.sha256(file_data).hexdigest()

            filepath = .quarantine_dir / 
            filepath.write_bytes(file_data)
             {: sha256, : (filepath), : }

     ():
        
         email
         email  policy

         eml_file  Path(smtp_quarantine_path).glob():
            msg = email.message_from_binary_file(
                eml_file.(), policy=policy.default
            )
             attachment  msg.iter_attachments():
                content = attachment.get_content()
                 (content, ):
                    content = content.encode()
                sha256 = hashlib.sha256(content).hexdigest()
                filename = attachment.get_filename()  

                filepath = .quarantine_dir / 
                filepath.write_bytes(content)
                 {
                    : sha256,
                    : (filepath),
                    : ,
                    : filename,
                    : msg[],
                    : msg[]
                }

     ():
        
         (filepath, )  f:
            content = f.read()
         {
            : hashlib.md5(content).hexdigest(),
            : hashlib.sha1(content).hexdigest(),
            : hashlib.sha256(content).hexdigest(),
            : (content)
        }