菜单
Analyze a malware sample — static analysis with Ghidra/Radare2/Capa, YARA scanning, string extraction, and VirusTotal/MalwareBazaar lookup.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | malware-analysis |
| description | Analyze a malware sample — static analysis with Ghidra/Radare2/Capa, YARA scanning, string extraction, and VirusTotal/MalwareBazaar lookup. |
Perform comprehensive malware analysis on the specified target.
Usage: /malware-analysis <target>
Where <target> is the path to the malware sample — e.g. /evidence/sample.exe, /evidence/malware.dll.
If no target is provided, ask the user for the sample path.
get_template(name="malware-analysis", target="$ARGUMENTS")Run a full 11-phase forensic investigation across all MCP servers — disk, memory, Windows artifacts, malware, network, OSINT, threat intel, timeline, and reporting.
Run a 6-phase forensic investigation — evidence intake, artifact collection, network analysis, threat intel, timeline reconstruction, and reporting.
Run a 7-phase incident response — triage, containment assessment, evidence collection, attack chain reconstruction, threat intel, impact assessment, and reporting.
Analyze a memory dump — process analysis, network connections, persistence mechanisms, malware detection with Volatility3, and reporting.
Analyze network traffic — PCAP triage, protocol analysis, anomaly detection, IoC extraction, stream reconstruction, and reporting.
Investigate a domain — DNS/subdomain enumeration, infrastructure analysis, threat assessment, web presence mapping, and reporting.