malware-report-writer

Name: malware-report-writer
Author: gl0bal01

43stars3forks

How to install malware-report-writer?

gl0bal01/malware-analysis-claude-skills/malware-report-writer

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-report-writer

Installs into the current project.

Summary

Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional deliv

Files · 1

View on GitHub

SKILL.md

1	# Malware Report Writer
2
3	Create professional, comprehensive malware analysis reports for enterprise security teams, incident response, and threat intelligence.
4
5	## When to Use This Skill
6
7	Use this skill when the user needs to:
8	- Create a complete malware analysis report from analysis findings
9	- Structure analysis results into professional documentation
10	- Write executive summaries for malware samples
11	- Format IOCs and detection rules for delivery
12	- Review or improve existing malware reports
13	- Prepare report documentation for stakeholders
14
15	## Quick Start
16
17	### Creating a New Report
18
19	1. Use the report template from `assets/report_template.md` as the base structure
20	2. Gather all analysis artifacts:
21	- Sample hashes and file information
22	- Static analysis findings (strings, imports, PE structure)
23	- Dynamic analysis observations (processes, registry, network, files)
24	- IOCs identified
25	- Detection rules created
26	3. Populate each section systematically
27	4. Review against best practices in `references/best_practices.md`
28
29	### Report Structure
30
31	The standard report includes these sections in order:
32
33	1. Executive Summary - High-level overview for non-technical stakeholders
34	2. Sample Information - Basic file metadata and hashes
35	3. Static Analysis - File structure, strings, imports/exports, resources
36	4. Dynamic Analysis - Runtime behavior, system changes, network activity
37	5. IOCs - Organized by type (file, network, host indicators)
38	6. Detection Rules - YARA rules and optionally Sigma rules
39	7. Malware Classification - Family, type, capabilities
40	8. Remediation and Mitigation - Actionable response steps
41	9. Technical Details - Additional deep-dive analysis
42	10. Conclusion - Final summary and assessment
43	11. References - External resources and links
44	12. Appendix - Timeline, tools used, screenshots
45
46	## Key Principles
47
48	### Professional Quality
49	- Use precise technical language with clear explanations
50	- Include all three hash types (MD5, SHA1, SHA256)
51	- Provide full context for every finding
52	- Document methodology and tools used
53	- Include timestamps and version information
54
55	### Professional Report Requirements
56	Industry-standard reports require:
57	- Complete technical documentation of malware samples
58	- Professional format suitable for enterprise delivery
59	- Working detection rules based on malware characteristics
60	- Clear IOCs that can be operationalized
61
62	Critical: The quality of your report reflects your professionalism. Allocate sufficient time for writing and review.
63
64	### Audience Awareness
65	Structure content for multiple audiences:
66	- Executive Summary: Non-technical decision makers
67	- Technical Sections: Security analysts and researchers
68	- IOCs/Detection: SOC teams and detection engineers
69	- Remediation: Incident responders
70
71	## Writing Guidelines
72
73	### Executive Summary
74	- 2-4 paragraphs maximum
75	- Plain language, minimal jargon
76	- Answer: What? How critical? What actions?
77	- Include key findings in bullet points
78
79	### Technical Analysis
80	- Document both positive and negative findings
81	- Provide evidence for every claim
82	- Use code blocks for technical artifacts
83	- Include screenshots when they add value
84	- Connect behaviors to specific evidence
85
86	### IOCs Section
87	Format:
88	- Group by type (file, network, host)
89	- Include context for each indicator
90	- Provide confidence levels if uncertain
91	- Test IOCs for accuracy before including
92
93	Defanging (required): All IOCs in reports MUST be defanged to prevent accidental activation:
94	- URLs: `http` → `hxxp`, `https` → `hxxps` (e.g., `hxxps://malicious[.]example[.]com/payload`)
95	- Domains: bracket the dot before the TLD (e.g., `evil[.]com`, `sub.domain[.]net`)
96	- Email addresses: `@` → `[@]` (e.g., `attacker[@]evil[.]com`)
97	- IP addresses: bracket each dot separator (e.g., `192[.]168[.]1[.]1`)
98
99	Avoid:
100	- Environment-specific artifacts
101	- Personal/analyst system information
102	- Common legitimate values
103	- Untested indicators
104
105	### Detection Rules
106	YARA Rules:
107	- Test against sample (must detect)
108	- Test against clean files (must not false positive)
109	- Include metadata: author, date, description, hash
110	- Use meaningful string and variable names
111	- Add comments explaining detection logic
112	- Set appropriate conditions to balance detection and false positives
113
114	Best practices:
115	```yara
116	rule Malware_Family_Variant {
117	meta:
118	description = "Detects Malware_Family based on C2 configuration"
119	author = "Analyst Name"
120	date = "2025-10-25"
121	hash = "abc123..."
122	reference = "Internal analysis"
123
124	strings:
125	$c2_config = { 48 8B ?? ?? ?? ?? ?? 48 8D ?? ?? } // Config

People who liked this also viewed

6 picks

Type

malware-report-writer

43stars3forks

View on GitHub

How to install malware-report-writer?

gl0bal01/malware-analysis-claude-skills/malware-report-writer

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-report-writer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Malware Report Writer
2
3	Create professional, comprehensive malware analysis reports for enterprise security teams, incident response, and threat intelligence.
4
5	## When to Use This Skill
6
7	Use this skill when the user needs to:
8	- Create a complete malware analysis report from analysis findings
9	- Structure analysis results into professional documentation
10	- Write executive summaries for malware samples
11	- Format IOCs and detection rules for delivery
12	- Review or improve existing malware reports
13	- Prepare report documentation for stakeholders
14
15	## Quick Start
16
17	### Creating a New Report
18
19	1. Use the report template from `assets/report_template.md` as the base structure
20	2. Gather all analysis artifacts:
21	- Sample hashes and file information
22	- Static analysis findings (strings, imports, PE structure)
23	- Dynamic analysis observations (processes, registry, network, files)
24	- IOCs identified
25	- Detection rules created
26	3. Populate each section systematically
27	4. Review against best practices in `references/best_practices.md`
28
29	### Report Structure
30
31	The standard report includes these sections in order:
32
33	1. Executive Summary - High-level overview for non-technical stakeholders
34	2. Sample Information - Basic file metadata and hashes
35	3. Static Analysis - File structure, strings, imports/exports, resources
36	4. Dynamic Analysis - Runtime behavior, system changes, network activity
37	5. IOCs - Organized by type (file, network, host indicators)
38	6. Detection Rules - YARA rules and optionally Sigma rules
39	7. Malware Classification - Family, type, capabilities
40	8. Remediation and Mitigation - Actionable response steps
41	9. Technical Details - Additional deep-dive analysis
42	10. Conclusion - Final summary and assessment
43	11. References - External resources and links
44	12. Appendix - Timeline, tools used, screenshots
45
46	## Key Principles
47
48	### Professional Quality
49	- Use precise technical language with clear explanations
50	- Include all three hash types (MD5, SHA1, SHA256)
51	- Provide full context for every finding
52	- Document methodology and tools used
53	- Include timestamps and version information
54
55	### Professional Report Requirements
56	Industry-standard reports require:
57	- Complete technical documentation of malware samples
58	- Professional format suitable for enterprise delivery
59	- Working detection rules based on malware characteristics
60	- Clear IOCs that can be operationalized
61
62	Critical: The quality of your report reflects your professionalism. Allocate sufficient time for writing and review.
63
64	### Audience Awareness
65	Structure content for multiple audiences:
66	- Executive Summary: Non-technical decision makers
67	- Technical Sections: Security analysts and researchers
68	- IOCs/Detection: SOC teams and detection engineers
69	- Remediation: Incident responders
70
71	## Writing Guidelines
72
73	### Executive Summary
74	- 2-4 paragraphs maximum
75	- Plain language, minimal jargon
76	- Answer: What? How critical? What actions?
77	- Include key findings in bullet points
78
79	### Technical Analysis
80	- Document both positive and negative findings
81	- Provide evidence for every claim
82	- Use code blocks for technical artifacts
83	- Include screenshots when they add value
84	- Connect behaviors to specific evidence
85
86	### IOCs Section
87	Format:
88	- Group by type (file, network, host)
89	- Include context for each indicator
90	- Provide confidence levels if uncertain
91	- Test IOCs for accuracy before including
92
93	Defanging (required): All IOCs in reports MUST be defanged to prevent accidental activation:
94	- URLs: `http` → `hxxp`, `https` → `hxxps` (e.g., `hxxps://malicious[.]example[.]com/payload`)
95	- Domains: bracket the dot before the TLD (e.g., `evil[.]com`, `sub.domain[.]net`)
96	- Email addresses: `@` → `[@]` (e.g., `attacker[@]evil[.]com`)
97	- IP addresses: bracket each dot separator (e.g., `192[.]168[.]1[.]1`)
98
99	Avoid:
100	- Environment-specific artifacts
101	- Personal/analyst system information
102	- Common legitimate values
103	- Untested indicators
104
105	### Detection Rules
106	YARA Rules:
107	- Test against sample (must detect)
108	- Test against clean files (must not false positive)
109	- Include metadata: author, date, description, hash
110	- Use meaningful string and variable names
111	- Add comments explaining detection logic
112	- Set appropriate conditions to balance detection and false positives
113
114	Best practices:
115	```yara
116	rule Malware_Family_Variant {
117	meta:
118	description = "Detects Malware_Family based on C2 configuration"
119	author = "Analyst Name"
120	date = "2025-10-25"
121	hash = "abc123..."
122	reference = "Internal analysis"
123
124	strings:
125	$c2_config = { 48 8B ?? ?? ?? ?? ?? 48 8D ?? ?? } // Config

People who liked this also viewed

6 picks

Type