| name | threat-intake-analysis |
| description | Analyze suspicious SMS/email messages, phishing links, redirects, domains, payloads, malware indicators, and suspected C2 infrastructure safely. Use when the user provides spam, smishing/phishing content, raw .eml headers, URLs, QR links, attachments, hashes, strange payloads, redirect chains, DNS/WHOIS/RDAP questions, C2 clues, exploit-chain questions, or asks what defenses to apply. |
Threat Intake Analysis
Use this skill to turn a suspicious message, link, payload, or infrastructure clue into Evidence, normalized Indicators, a likely attack-chain narrative, and defensive actions. This is a first-class workflow for authorized defensive investigation of spam, phishing, malware delivery, and command-and-control infrastructure. See GLOSSARY.md for shared terms.
Handoffs: Use web-inspection-forensics for web capture and URL map work, reverse-engineering-analysis for payload and attachment static analysis, exploitation-sandbox only for approved active validation, and network-reachability when lookups or fetches fail.
Safety Model
Default to static and passive analysis. Treat the user-provided message, screenshot, .eml, header text, attachment hash, or local sample as the initial Target. Do not treat a link inside that Target as authorized just because it appears in the message.
Approval-gated actions:
- Visiting a live URL, following redirects, loading remote images, resolving active tracking links, submitting forms, clicking through interstitials, or using a browser.
- Downloading, unpacking, opening, detonating, or executing attachments or payloads.
- Querying public scanners or sandboxes with private customer URLs, samples, headers, email addresses, phone numbers, or tokens.
- Interacting with suspected C2, phishing kits, compromised hosts, callback endpoints, or third-party infrastructure.
Never use the host browser or a browser profile with real credentials. Use an isolated Workspace Container, VM snapshot, browser profile with no saved accounts, and a scoped network profile. Stop on redirects to newly discovered hosts until that host is authorized.
Quick Start
- Preserve the original. Save raw message text,
.eml, screenshot/OCR, QR decode output, attachments, hashes, source app, sender display, received time, and user report context.
- Extract observables offline. Parse URLs, domains, IPs, email addresses, phone numbers, sender IDs, reply-to/return-path, received hops, Authentication-Results, attachment names, MIME types, file hashes, QR URLs, and encoded payload fragments.
- Normalize indicators. Defang for display, canonicalize URLs without dropping path/query evidence, compute hashes, preserve timestamps, and mark indicator source lines or artifact paths.
- Passive enrichment first. Use DNS/RDAP/WHOIS, certificate transparency, passive DNS, existing urlscan/VirusTotal/MISP records, vendor advisories, and search results only when privacy allows. Do not submit new private samples without approval.
- Map the chain. Identify lure theme, impersonated brand, delivery channel, redirectors, traffic distribution system, landing page, credential collection, payload delivery, exploit or social-engineering step, persistence clue, and C2/infrastructure relationships.
- Decide if active detonation is needed. If static/passive evidence is sufficient for defense, stop. If not, ask for explicit approval with target hosts, allowed redirects, network profile, capture requirements, and stop conditions.
- Defend and report. Produce blocking rules, mailbox search terms, user/account response steps, IOC export, evidence artifacts, and remaining gaps.
Email And SMS Triage
- Email headers: inspect
From, Sender, Reply-To, Return-Path, Message-ID, Received, Authentication-Results, SPF, DKIM, DMARC, ARC, envelope sender, originating IPs, and mailing-list rewrites.
- Content: compare display name vs address, brand impersonation, urgent payment/password/MFA language, callback numbers, QR codes, link text vs href, hidden text, remote images, HTML forms, and JavaScript or meta refresh.
- SMS/MMS: preserve sender ID/short code/phone number, carrier timestamp, displayed link, full URL after copy, QR image if present, attachment/media metadata, and any call-back number. Do not click on the user's phone.
- Attachments: identify format before opening: Office macro documents, PDFs, HTML/HTA, ZIP/ISO/VHD/IMG, LNK, OneNote, JavaScript, SVG, APK/IPA, scripts, and password-protected archives.
Link And Redirect Analysis
Passive first:
- Parse all URLs and preserve full path/query/fragment as evidence.
- Identify link shorteners, QR redirection, open redirect parameters, encoded URLs, base64 blobs, suspicious homoglyph/punycode domains, and brand lookalikes.
- Use DNS
A/AAAA/CNAME/NS/MX/TXT/SOA, RDAP/WHOIS registrar data, nameservers, ASN/hosting, certificate transparency, prior passive DNS, and existing scan records.
- Check for infrastructure patterns: fast-flux-like IP churn, newly registered domains, disposable TLDs, compromised CMS paths, CDN/proxy fronting, parked domain transitions, and shared tracking IDs.
Active only after approval:
- Use a throwaway browser profile or CLI inside the isolated workspace.
- Capture full redirect chain with method, status, headers, cookies set, body hash, screenshot, HAR, DNS answers, TLS certificate, final URL, and timing.
- Disable or contain downloads by default; if download is the objective, store to a quarantine folder and hash immediately.
- Stop if a redirect leaves the approved target set, asks for credentials/payment/MFA, triggers a file download not in scope, or shows unexpected personal data.
Payload And Malware Triage
Static first:
- Record hash, size, type, magic bytes, filenames, archive members, MIME type, entropy, timestamps, embedded URLs/domains/IPs, strings, metadata, macros, scripts, signatures, and packer clues.
- Recommended local tools by type:
file, sha256sum, strings, exiftool, xxd, zipdetails, 7z l, oletools, pdfid, pdf-parser, rtfobj, yara, clamscan, jq, tshark, and language-specific deobfuscators.
- For scripts and HTML smuggling, beautify and deobfuscate in copies; preserve original bytes and decoded layers as separate artifacts with hashes.
- Build YARA or Sigma-style detection only from stable traits, then note false-positive risk and required test corpus.
Dynamic only after static triage and approval:
- Prefer VM snapshots or malware sandboxes such as REMnux plus FLARE VM, CAPE/Cuckoo-style sandboxes, or an offline Workspace Container for scripts that do not need OS-level behavior.
- Start with no internet or fake internet (FakeDNS/INetSim) when possible, then move to approved-target egress if live infrastructure must be observed.
- Capture process tree, file writes, registry changes, DNS, HTTP/TLS, PCAP, stdout/stderr, screenshots, dropped files, and mutex/service/task names.
- Do not bypass anti-analysis or execute destructive payloads unless the user's authorization explicitly includes that technique and environment.
C2 And Infrastructure Identification
Look for multiple corroborating signals before calling infrastructure C2:
- Beacon-like timing, repeated callbacks, unique host/user identifiers, tasking endpoints, staged payload downloads, encrypted blobs, DGA-like domains, TXT record use, unusual User-Agent strings, JA3/JA4/TLS clues, and hard-coded campaign IDs.
- Shared infrastructure across samples: domains, IPs, TLS certificates, nameservers, registrars, ASNs, URL path conventions, favicon/hash reuse, web kit fingerprints, or redirector templates.
- ATT&CK-style relationships: phishing delivery, user execution, drive-by compromise, ingress tool transfer, application-layer C2, DNS C2, encrypted channel, and exfiltration staging. Treat mapping as taxonomy, not proof.
Confidence labels:
- confirmed: direct sandbox or captured network evidence shows command, tasking, credential collection, payload delivery, or operator-controlled response.
- likely: multiple passive signals point to malicious infrastructure but no live interaction occurred.
- speculative: single weak signal such as age, hosting, or lookalike domain.
Defense Measures
Prioritize actions by evidence confidence and blast radius:
- Mailbox: search and purge related messages, block sender/domain patterns, update allow/block lists, detonate attachments in the mail security stack, and preserve original messages for review.
- Identity: reset passwords, revoke sessions/tokens, require MFA reset, review OAuth grants, and check sign-in logs if a user clicked or entered credentials.
- Network: block malicious domains/URLs/IPs at DNS, proxy, firewall, EDR, and secure web gateway; add exceptions cautiously when infrastructure is shared/CDN-backed.
- Endpoint: search for file hashes, dropped filenames, command lines, persistence keys, scheduled tasks, process trees, and EDR alerts.
- Email authentication: harden SPF/DKIM/DMARC alignment, brand protection, inbound impersonation rules, external sender tagging, attachment sandboxing, and URL rewriting.
- Detection sharing: export defanged IOCs, STIX/MISP-style attributes, YARA/Sigma drafts, and evidence links with source, first seen, last seen, confidence, and handling caveats.
- User response: notify affected users with concise guidance, preserve evidence, and avoid telling users to click or forward active links.
Output Shape
Return:
- Scope: source, authorization, artifacts, privacy constraints, and excluded actions.
- Intake Evidence: raw message/sample references, hashes, screenshots/OCR, header summary, and tool versions.
- Indicators: URLs, domains, IPs, emails, phones, hashes, file names, certificates, ASNs, and confidence.
- Redirect/Delivery Chain: observed or hypothesized chain with evidence for each edge.
- Payload/C2 Assessment: static and dynamic signals, ATT&CK-style mapping, confidence, and gaps.
- Defense Actions: blocking, mailbox search, account response, endpoint hunts, detection rules, and escalation steps.
- Approval Needs: exact target hosts, tool class, network profile, privacy notes, stop conditions, and proof bar for any active analysis.
References To Use As Background
- NIST SP 800-83 Rev. 1 for malware prevention and incident handling.
- CISA/NSA/FBI phishing guidance for reducing phishing impact.
- MITRE ATT&CK for phishing, drive-by compromise, ingress tool transfer, and command-and-control taxonomy.
- OASIS STIX 2.1 and MISP for structured indicator exchange.
- YARA documentation for stable malware/file signatures.
- REMnux, FLARE VM, CAPE, and Cuckoo documentation for isolated malware-analysis lab patterns.
