malware-analysis--sandboxing

# Malware Analysis & Sandboxing ## Purpose Enable Claude to assist with malware analysis workflows including static analysis of file properties and code, dynamic behavioral analysis interpretation, YARA rule generation, sandbox configuration, and malware family identification. Claude analyzes provided artifacts directly and orchestrates scripts for automated processing. > **Safety Warning**: Never execute suspicious files outside of isolated, controlled environments. Use dedicated VMs or sandboxes with network isolation and snapshot capability. --- ## Activation Triggers This skill activates when the user asks about: - Analyzing a suspicious file, binary, or script - Generating YARA rules for malware detection - Setting up a malware analysis sandbox - Interpreting Cuckoo/CAPE/AnyRun sandbox reports - Identifying malware family or behavior - Creating IOCs from malware samples - Static analysis of PE/ELF files - Memory forensics for malware artifacts - Behavioral analysis (process creation, network, registry, file changes) --- ## Prerequisites ```bash pip install yara-python pefile python-magic requests ssdeep ``` **Recommended analysis tools:** - `Cuckoo Sandbox / CAPE` — Automated dynamic analysis - `VirusTotal API` — Multi-engine scanning and intel - `YARA` — Pattern matching engine - `Ghidra / IDA Pro` — Deep binary analysis (→ Skill 04) - `Volatility 3` — Memory forensics - `DIE (Detect-It-Easy)` — Packer/compiler detection - `Pestudio` — Windows PE static analys...