gl0bal01/malware-analysis-claude-skills · malware-dynamic-analysis/SKILL.md
malware-dynamic-analysis skillA
Behavioral analysis of a sample executed in an isolated VM. Use after triage when runtime behavior, C2 traffic, dropped files, persistence, or injection must be observed. Claude produces a tailored VM runbook from triage predictions, then parses the exported text evidence (Procmon CSV, Sysmon JSON/CSV, tshark output, autoruns, strings) on the host to reconstruct behavior and extract IOCs. The analyst runs the VM; Claude never executes the sample.
Latest version
mdr add gl0bal01/malware-analysis-claude-skills/malware-dynamic-analysis@git:20260905.e1d9a1aExact content
mdr add gl0bal01/malware-analysis-claude-skills/malware-dynamic-analysis@sha256:1a687c61aaee9620Badge
[](https://markdownregistry.com/a/art_6g6g3i3ze7fqugze)
0 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260905.e1d9a1a latest | 2026-09-05 | e1d9a1a | 19,642 B | A | view · diff |
| git:20260905.fd80b2a | 2026-09-05 | fd80b2a | 19,247 B | A | view · diff |
| git:20260412.09f91e4 | 2026-04-12 | 09f91e4 | 21,178 B | A | view · diff |
| git:20251027.43cc347 | 2025-10-27 | 43cc347 | 21,151 B | A | view |
Audit of the latest version
A 17 of 17 checks passed. Deterministic, no model, same answer every run.
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (19642 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
GitHub
gl0bal01/malware-analysis-claude-skills · 46 stars · license MIT · pushed 2026-09-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_6g6g3i3ze7fqugze GET https://markdownregistry.com/api/v1/resolve?ref=gl0bal01/malware-analysis-claude-skills/malware-dynamic-analysis GET https://markdownregistry.com/api/v1/blob/1a687c61aaee962091b0477d9128a14798f0683aff02b2803e80040d2daaab38