analyzing-api-call-traces
starsforks
How to install analyzing-api-call-traces?
meltedinhex/analyst-ai-pack/analyzing-api-call-traces
$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-api-call-tracesAnalyzes API call traces from a sandbox or API monitor (JSON) to group calls by
SKILL.md
| 1 | # Analyzing API Call Traces |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have a JSON API trace (CAPE/Cuckoo "apistats"/calls, API Monitor export) from a detonation. |
| 6 | - You need to translate raw API calls into high-level behaviors and flag suspicious sequences |
| 7 | (e.g., `VirtualAllocEx` → `WriteProcessMemory` → `CreateRemoteThread`). |
| 8 | |
| 9 | **Do not use** this as a substitute for detonation — it consumes an existing trace produced in an |
| 10 | isolated sandbox. |
| 11 | |
| 12 | ## Prerequisites |
| 13 | |
| 14 | - A JSON API trace with at least an API name per call (and optionally arguments). |
| 15 | |
| 16 | ## Safety & Handling |
| 17 | |
| 18 | - Consume traces only; never execute the sample to generate one outside a sandbox. |
| 19 | |
| 20 | ## Workflow |
| 21 | |
| 22 | ### Step 1: Group calls by category |
| 23 | |
| 24 | ```bash |
| 25 | python scripts/analyst.py classify trace.json |
| 26 | ``` |
| 27 | |
| 28 | Buckets calls into process, memory, file, registry, network, crypto, and synchronization. |
| 29 | |
| 30 | ### Step 2: Detect behavior signatures |
| 31 | |
| 32 | Matches ordered API sequences that indicate techniques — remote injection, hollowing, |
| 33 | self-deletion, dynamic API resolution (`LoadLibrary`/`GetProcAddress` bursts). |
| 34 | |
| 35 | ### Step 3: Prioritize and report |
| 36 | |
| 37 | Rank detected behaviors by severity and map each to ATT&CK. |
| 38 | |
| 39 | ## Validation |
| 40 | |
| 41 | - Each API call is categorized; unknown APIs are reported, not dropped silently. |
| 42 | - Injection-style sequences are detected only when the ordered prerequisites are present. |
| 43 | - Detected behaviors map to ATT&CK techniques. |
| 44 | |
| 45 | ## Pitfalls |
| 46 | |
| 47 | - Flagging individual benign APIs out of context — the sequence matters. |
| 48 | - Assuming call order in the JSON equals execution order without a timestamp/index. |
| 49 | - Ignoring failed calls (non-zero error) that never actually executed the behavior. |
| 50 | |
| 51 | ## References |
| 52 | |
| 53 | - See [`references/api-reference.md`](references/api-reference.md) for the classifier. |
| 54 | - ATT&CK T1106 and the Windows API Index (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
