building-a-sample-management-workflow

Name: building-a-sample-management-workflow
Author: meltedinhex

18stars5forks

How to install building-a-sample-management-workflow?

meltedinhex/analyst-ai-pack/building-a-sample-management-workflow

$npx -y skills add meltedinhex/analyst-ai-pack --skill building-a-sample-management-workflow

Installs into the current project.

Summary

Establishes a disciplined malware sample repository: content-addressed storage by

Files · 1

View on GitHub

SKILL.md

1	# Building a Sample Management Workflow
2
3	## When to Use
4
5	- You are accumulating malware samples and need a repeatable, safe way to store and find them.
6	- You need metadata and provenance (source, date, case) attached to every sample.
7	- You want content-addressed storage so the same sample is never duplicated or misnamed.
8
9	Do not use original filenames or loose folders as the organizing principle — names are
10	attacker-controlled and collide; address samples by hash.
11
12	## Prerequisites
13
14	- The hashing skill for content addressing; encrypted/password-protected archive tooling.
15	- A defined storage location inside the isolated lab.
16
17	## Safety & Handling
18
19	- Store every sample inside a password-protected archive (commonly `infected`) so it cannot
20	auto-execute or be scanned/quarantined by host AV.
21	- Strip the executable bit / neutralize the extension at rest; restore only inside the lab.
22
23	## Workflow
24
25	### Step 1: Content-address on intake
26
27	On receipt, compute SHA-256 and store the sample under a path derived from its hash
28	(e.g., `samples/ab/cd/<sha256>`), preventing duplicates and name collisions.
29
30	```bash
31	python scripts/analyst.py intake sample.bin --source "phishing-case-42" --store ./samples
32	```
33
34	### Step 2: Record metadata
35
36	Write a metadata record per sample: hashes, original name, source, intake date, case ID,
37	file type, and analyst — kept next to the sample or in an index.
38
39	### Step 3: Archive safely
40
41	Wrap the sample in a password-protected archive; keep the inert copy out of host AV's reach and
42	the metadata in plaintext for searchability.
43
44	### Step 4: Maintain chain of custody
45
46	Append-only log each access/action (who, when, what) so the sample's handling is auditable.
47
48	### Step 5: Index and search
49
50	Build a searchable index over metadata so samples can be found by hash, family, source, or case
51	without touching the raw bytes.
52
53	## Validation
54
55	- The same sample always lands at the same hash-derived path (idempotent intake).
56	- Every sample has a complete metadata record and an access log entry.
57	- Samples are stored password-protected; metadata is searchable in plaintext.
58
59	## Pitfalls
60
61	- Organizing by attacker-supplied filename, causing collisions and confusion.
62	- Storing live samples unarchived where host AV deletes them mid-analysis.
63	- Losing provenance, so an indicator cannot be traced back to its case.
64
65	## References
66
67	- See [`references/api-reference.md`](references/api-reference.md) for the intake/indexer.
68	- NIST SP 800-86 and MalwareBazaar conventions (linked in frontmatter).

People who liked this also viewed

6 picks

Type

paperclip-create-agentCreate new agents in Paperclip with governance-aware hiring. Use when you need to inspect adapter configuration options, compare existing agent configs, draft a new agent prompt/config, and submit a hSkillsJul 2026157k5
subagent-driven-developmentUse when executing implementation plans with independent tasks in the current sessionSkillsJul 2026154k259k
dispatching-parallel-agentsUse when facing 2+ independent tasks that can be worked on without shared state or sequential dependenciesSkillsJul 2026143k259k
browser-act-skill-forgeForges reusable Skill packages (SKILL.md + scripts) from website exploration via browser-act — no re-exploration later. Use when: user wants a reusable Skill for any website, needs to understand a sitSkillsJul 202685k4.6k
wizardGenerate an interactive bash wizard that walks a human through a manual procedure — third-party setup, a one-off migration, an A→B state transition — opening URLs, capturing values, confirming each stSkillsJul 202675k182k
wonda-cliUsing the Wonda CLI to generate images, videos, music, and audio from the terminal — plus LinkedIn, Reddit, and X/Twitter research and automationSkillsJul 202666k137

building-a-sample-management-workflow

18stars5forks

View on GitHub

How to install building-a-sample-management-workflow?

meltedinhex/analyst-ai-pack/building-a-sample-management-workflow

$npx -y skills add meltedinhex/analyst-ai-pack --skill building-a-sample-management-workflow

Installs into the current project.

Summary

Establishes a disciplined malware sample repository: content-addressed storage by

Files · 1

View on GitHub

SKILL.md

1	# Building a Sample Management Workflow
2
3	## When to Use
4
5	- You are accumulating malware samples and need a repeatable, safe way to store and find them.
6	- You need metadata and provenance (source, date, case) attached to every sample.
7	- You want content-addressed storage so the same sample is never duplicated or misnamed.
8
9	Do not use original filenames or loose folders as the organizing principle — names are
10	attacker-controlled and collide; address samples by hash.
11
12	## Prerequisites
13
14	- The hashing skill for content addressing; encrypted/password-protected archive tooling.
15	- A defined storage location inside the isolated lab.
16
17	## Safety & Handling
18
19	- Store every sample inside a password-protected archive (commonly `infected`) so it cannot
20	auto-execute or be scanned/quarantined by host AV.
21	- Strip the executable bit / neutralize the extension at rest; restore only inside the lab.
22
23	## Workflow
24
25	### Step 1: Content-address on intake
26
27	On receipt, compute SHA-256 and store the sample under a path derived from its hash
28	(e.g., `samples/ab/cd/<sha256>`), preventing duplicates and name collisions.
29
30	```bash
31	python scripts/analyst.py intake sample.bin --source "phishing-case-42" --store ./samples
32	```
33
34	### Step 2: Record metadata
35
36	Write a metadata record per sample: hashes, original name, source, intake date, case ID,
37	file type, and analyst — kept next to the sample or in an index.
38
39	### Step 3: Archive safely
40
41	Wrap the sample in a password-protected archive; keep the inert copy out of host AV's reach and
42	the metadata in plaintext for searchability.
43
44	### Step 4: Maintain chain of custody
45
46	Append-only log each access/action (who, when, what) so the sample's handling is auditable.
47
48	### Step 5: Index and search
49
50	Build a searchable index over metadata so samples can be found by hash, family, source, or case
51	without touching the raw bytes.
52
53	## Validation
54
55	- The same sample always lands at the same hash-derived path (idempotent intake).
56	- Every sample has a complete metadata record and an access log entry.
57	- Samples are stored password-protected; metadata is searchable in plaintext.
58
59	## Pitfalls
60
61	- Organizing by attacker-supplied filename, causing collisions and confusion.
62	- Storing live samples unarchived where host AV deletes them mid-analysis.
63	- Losing provenance, so an indicator cannot be traced back to its case.
64
65	## References
66
67	- See [`references/api-reference.md`](references/api-reference.md) for the intake/indexer.
68	- NIST SP 800-86 and MalwareBazaar conventions (linked in frontmatter).

People who liked this also viewed

6 picks

Type