triage-malware

name	triage-malware
description	Triage a suspected malicious file hash. Use when investigating malware alerts or suspicious files. Analyzes GTI file report, behavioral indicators, identifies affected hosts, enriches network IOCs, and recommends containment actions.
required_roles	{"chronicle":"roles/chronicle.viewer","soar":"roles/chronicle.editor","gti":"GTI Enterprise"}
personas	["tier2-analyst","tier3-analyst","incident-responder"]

Malware Triage Skill

Perform initial analysis and context gathering for a suspected malicious file hash identified during an investigation or alert.

Inputs

• FILE_HASH - MD5, SHA1, or SHA256 hash of the suspected file
• CASE_ID - SOAR case ID for documentation
• ALERT_GROUP_IDENTIFIERS - Alert group identifiers from the case
• (Optional) TIME_FRAME_HOURS - Lookback period (default: 72)

Workflow

Step 1: Get Case Context

secops-soar.get_case_full_details(case_id=CASE_ID)

Step 2: GTI File Report

gti-mcp.get_file_report(hash=FILE_HASH)

Record:

• Detection ratio (e.g., 45/70 engines)
• Malware family classification
• First/last seen dates
• Associated threat actors or campaigns

Step 3: GTI Behavior Summary

gti-mcp.get_file_behavior_summary(hash=FILE_HASH)

Extract behavioral indicators:

• Network: Contacted IPs/domains → NETWORK_IOCs_GTI
• File system: Dropped files, modified files
• Registry: Modified keys
• MITRE TTPs: Observed techniques from sandbox

Step 4: SIEM Execution Check

Search for file execution events:

secops-mcp.search_security_events(
    text='target.file.sha256 = "FILE_HASH" OR target.file.md5 = "FILE_HASH"',
    hours_back=TIME_FRAME_HOURS
)

Look for: PROCESS_LAUNCH, FILE_CREATION, FILE_MODIFICATION

Identify:

• AFFECTED_HOSTS - Machines where file was seen
• AFFECTED_USERS - Users who executed/accessed the file

Step 5: SIEM Network Activity

Search for network connections from processes with this hash:

secops-mcp.search_security_events(
    text='principal.process.file.sha256 = "FILE_HASH"',
    hours_back=TIME_FRAME_HOURS
)

Extract: NETWORK_IOCs_SIEM (contacted IPs/domains)

Step 6: Enrich Network IOCs

Combine NETWORK_IOCs_GTI + NETWORK_IOCs_SIEM → ALL_NETWORK_IOCs

For each network IOC, use /enrich-ioc:

• Check GTI reputation
• Check SIEM presence
• Check IOC match status

Step 7: Check Related Cases

Use /find-relevant-case with:

SEARCH_TERMS = AFFECTED_HOSTS + AFFECTED_USERS + ALL_NETWORK_IOCs

Step 8: Synthesize & Document

Use /document-in-case with assessment:

Malware Triage for Hash FILE_HASH:
- GTI Classification: [family, detection ratio]
- Behavior: [network, files, registry]
- Affected Hosts: [list]
- Network IOCs: [with enrichment]
- Related Cases: [list]

Assessment: [severity level]

Recommendation:
- [ ] Isolate affected hosts
- [ ] Block network IOCs
- [ ] Escalate to IR
- [ ] Monitor only

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
MALWARE_CLASSIFICATION	GTI verdict and malware family (e.g., "Emotet - Banking Trojan")
BEHAVIORAL_IOCS	Network IOCs from sandbox analysis (contacted IPs/domains)
AFFECTED_HOSTS	Hosts where this malware was executed or detected
AFFECTED_USERS	Users who executed or accessed the malware
TRIAGE_VERDICT	Overall verdict: malicious, suspicious, or clean

Severity Assessment Matrix

Factor	Low	Medium	High	Critical
GTI Detection	< 5 engines	5-20 engines	20-50 engines	> 50 engines
Execution	Not executed	Downloaded only	Executed	Active C2
Spread	Single host	2-5 hosts	5-20 hosts	> 20 hosts
Network IOCs	None observed	Benign	Suspicious	Known malicious
Data at Risk	None	Low value	PII/credentials	Critical systems

Recommended Actions by Severity

Critical/High:

1. Immediately isolate affected hosts
2. Block network IOCs at firewall
3. Escalate to Incident Response
4. Preserve forensic evidence

Medium:

1. Monitor affected hosts closely
2. Block known malicious IOCs
3. Schedule endpoint scan
4. Escalate to Tier 2

Low:

1. Document findings
2. Monitor for recurrence
3. Close with detailed notes