[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFX1J31NT45A55628AVX9D":3,"skill-same:01M6AFX1J31NT45A55628AVX9D":122},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AFX1J31NT45A55628AVX9D","performing-malware-ioc-extraction",null,"Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ioc","performing malware ioc extraction","malware","extraction","stix","cybersecurity","analysis","indicators","network","analyzing","yara","malware-analysis","c2","file","malicious","cti","threat-intelligence","mitre-attack","reverse-engineering","engineering","2026-11-10 10:12:30",false,"---\nname: performing-malware-ioc-extraction\ndescription: Malware IOC extraction is the process of analyzing malicious software\n  to identify actionable indicators of compromise including file hashes, network indicators\n  (C2 domains, IP addresses, URLs), regist\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- malware-analysis\n- yara\n- reverse-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1071\n---\n# Performing Malware IOC Extraction\n\n## Overview\n\nMalware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), registry modifications, mutex names, embedded strings, and behavioral artifacts. This skill covers static analysis with PE parsing and string extraction, dynamic analysis with sandbox detonation, automated IOC extraction using tools like YARA, and formatting results as STIX 2.1 indicators for sharing.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing malware ioc extraction\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `pefile`, `yara-python`, `oletools`, `stix2` libraries\n- Access to malware analysis sandbox (Cuckoo, CAPE, Any.Run, Joe Sandbox)\n- VirusTotal API key for enrichment\n- Isolated analysis environment (VM or container)\n- Understanding of PE file format, common packing techniques\n- Familiarity with YARA rule syntax\n\n## Key Concepts\n\n### Static Analysis IOCs\n- **File Hashes**: MD5, SHA-1, SHA-256 of the sample and any dropped files\n- **Import Hash (imphash)**: Hash of imported function table, groups malware families\n- **Rich Header Hash**: PE rich header hash for compiler fingerprinting\n- **Strings**: Embedded URLs, IP addresses, domain names, registry paths, mutex names\n- **PE Metadata**: Compilation timestamp, section names, resources, digital signatures\n- **Embedded Artifacts**: PDB paths, version info, certificate details\n\n### Dynamic Analysis IOCs\n- **Network Activity**: DNS queries, HTTP requests, TCP\u002FUDP connections, SSL certificates\n- **File System**: Created\u002Fmodified\u002Fdeleted files and directories\n- **Registry**: Created\u002Fmodified registry keys and values\n- **Process**: Spawned processes, injected processes, service creation\n- **Behavioral**: API calls, mutex creation, scheduled tasks, persistence mechanisms\n\n### YARA Rules\nYARA is a pattern-matching tool for identifying and classifying malware. Rules consist of strings (text, hex, regex) and conditions that define matching logic. Rules can detect malware families, packers, exploit kits, and specific campaign tools.\n\n## Workflow\n\n### Step 1: Static Analysis - PE Parsing and Hash Generation\n\n```python\nimport pefile\nimport hashlib\nimport os\n\ndef analyze_pe(filepath):\n    \"\"\"Extract IOCs from a PE file through static analysis.\"\"\"\n    iocs = {\"hashes\": {}, \"pe_info\": {}, \"strings\": [], \"imports\": []}\n\n    # Calculate file hashes\n    with open(filepath, \"rb\") as f:\n        data = f.read()\n    iocs[\"hashes\"][\"md5\"] = hashlib.md5(data).hexdigest()\n    iocs[\"hashes\"][\"sha1\"] = hashlib.sha1(data).hexdigest()\n    iocs[\"hashes\"][\"sha256\"] = hashlib.sha256(data).hexdigest()\n    iocs[\"hashes\"][\"file_size\"] = len(data)\n\n    # Parse PE headers\n    try:\n        pe = pefile.PE(filepath)\n        iocs[\"hashes\"][\"imphash\"] = pe.get_imphash()\n        iocs[\"pe_info\"][\"compilation_time\"] = str(pe.FILE_HEADER.TimeDateStamp)\n        iocs[\"pe_info\"][\"machine_type\"] = hex(pe.FILE_HEADER.Machine)\n        iocs[\"pe_info\"][\"subsystem\"] = pe.OPTIONAL_HEADER.Subsystem\n\n        # Extract sections\n        iocs[\"pe_info\"][\"sections\"] = []\n        for section in pe.sections:\n            iocs[\"pe_info\"][\"sections\"].append({\n                \"name\": section.Name.decode(\"utf-8\", errors=\"ignore\").strip(\"\\x00\"),\n                \"virtual_size\": section.Misc_VirtualSize,\n                \"raw_size\": section.SizeOfRawData,\n                \"entropy\": section.get_entropy(),\n                \"md5\": section.get_hash_md5(),\n            })\n\n        # Extract imports\n        if hasattr(pe, \"DIRECTORY_ENTRY_IMPORT\"):\n            for entry in pe.DIRECTORY_ENTRY_IMPORT:\n                dll_name = entry.dll.decode(\"utf-8\", errors=\"ignore\")\n                functions = [\n                    imp.name.decode(\"utf-8\", errors=\"ignore\")\n                    for imp in entry.imports\n                    if imp.name\n                ]\n                iocs[\"imports\"].append({\"dll\": dll_name, \"functions\": functions})\n\n        # Check for suspicious characteristics\n        iocs[\"pe_info\"][\"is_dll\"] = pe.is_dll()\n        iocs[\"pe_info\"][\"is_driver\"] = pe.is_driver()\n        iocs[\"pe_info\"][\"is_exe\"] = pe.is_exe()\n\n        # Version info\n        if hasattr(pe, \"VS_VERSIONINFO\"):\n            for entry in pe.FileInfo:\n                for st in entry:\n                    for item in st.entries.items():\n                        key = item[0].decode(\"utf-8\", errors=\"ignore\")\n                        val = item[1].decode(\"utf-8\", errors=\"ignore\")\n                        iocs[\"pe_info\"][f\"version_{key}\"] = val\n\n        pe.close()\n\n    except pefile.PEFormatError as e:\n        iocs[\"pe_info\"][\"error\"] = str(e)\n\n    return iocs\n```\n\n### Step 2: String Extraction and IOC Pattern Matching\n\n```python\nimport re\n\ndef extract_ioc_strings(filepath):\n    \"\"\"Extract IOC-relevant strings from binary file.\"\"\"\n    patterns = {\n        \"ipv4\": re.compile(\n            r\"\\b(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}\"\n            r\"(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\b\"\n        ),\n        \"domain\": re.compile(\n            r\"\\b(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+\"\n            r\"(?:com|net|org|io|ru|cn|tk|xyz|top|info|biz|cc|ws|pw)\\b\"\n        ),\n        \"url\": re.compile(\n            r\"https?:\u002F\u002F[^\\s\\\"'\u003C>]{5,200}\"\n        ),\n        \"email\": re.compile(\n            r\"\\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}\\b\"\n        ),\n        \"registry\": re.compile(\n            r\"(?:HKEY_[A-Z_]+|HKLM|HKCU|HKU|HKCR|HKCC)\"\n            r\"\\\\[\\\\a-zA-Z0-9_ .{}-]+\"\n        ),\n        \"filepath_windows\": re.compile(\n            r\"[A-Z]:\\\\(?:[^\\\\\u002F:*?\\\"\u003C>|\\r\\n]+\\\\)*[^\\\\\u002F:*?\\\"\u003C>|\\r\\n]+\"\n        ),\n        \"mutex\": re.compile(\n            r\"(?:Global\\\\|Local\\\\)[a-zA-Z0-9_\\-{}.]{4,}\"\n        ),\n        \"useragent\": re.compile(\n            r\"Mozilla\u002F[45]\\.0[^\\\"']{10,200}\"\n        ),\n        \"bitcoin\": re.compile(\n            r\"\\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\\b\"\n        ),\n        \"pdb_path\": re.compile(\n            r\"[A-Z]:\\\\[^\\\"]{5,200}\\.pdb\"\n        ),\n    }\n\n    with open(filepath, \"rb\") as f:\n        data = f.read()\n\n    # Extract ASCII strings (min length 4)\n    ascii_strings = re.findall(rb\"[\\x20-\\x7e]{4,}\", data)\n    # Extract Unicode strings\n    unicode_strings = re.findall(\n        rb\"(?:[\\x20-\\x7e]\\x00){4,}\", data\n    )\n\n    all_strings = [s.decode(\"ascii\", errors=\"ignore\") for s in ascii_strings]\n    all_strings += [\n        s.decode(\"utf-16-le\", errors=\"ignore\") for s in unicode_strings\n    ]\n\n    extracted = {category: set() for category in patterns}\n\n    for string in all_strings:\n        for category, pattern in patterns.items():\n            matches = pattern.findall(string)\n            for match in matches:\n                extracted[category].add(match)\n\n    # Convert sets to sorted lists\n    return {k: sorted(v) for k, v in extracted.items() if v}\n```\n\n### Step 3: YARA Rule Scanning\n\n```python\nimport yara\n\ndef scan_with_yara(filepath, rules_path):\n    \"\"\"Scan file with YARA rules for malware classification.\"\"\"\n    rules = yara.compile(filepath=rules_path)\n    matches = rules.match(filepath)\n\n    results = []\n    for match in matches:\n        result = {\n            \"rule\": match.rule,\n            \"namespace\": match.namespace,\n            \"tags\": match.tags,\n            \"meta\": match.meta,\n            \"strings\": [],\n        }\n        for offset, identifier, data in match.strings:\n            result[\"strings\"].append({\n                \"offset\": hex(offset),\n                \"identifier\": identifier,\n                \"data\": data.hex() if len(data) \u003C 100 else data[:100].hex() + \"...\",\n            })\n        results.append(result)\n\n    return results\n\n\n# Example YARA rule for common malware indicators\nSAMPLE_YARA_RULE = \"\"\"\nrule Suspicious_Network_Indicators {\n    meta:\n        description = \"Detects suspicious network-related strings\"\n        author = \"CTI Analyst\"\n        severity = \"medium\"\n    strings:\n        $ua1 = \"Mozilla\u002F5.0\" ascii\n        $cmd1 = \"cmd.exe \u002Fc\" ascii nocase\n        $ps1 = \"powershell\" ascii nocase\n        $wget = \"wget\" ascii nocase\n        $curl = \"curl\" ascii nocase\n        $b64 = \"base64\" ascii nocase\n        $reg1 = \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" ascii nocase\n    condition:\n        uint16(0) == 0x5A4D and\n        (2 of ($ua1, $cmd1, $ps1, $wget, $curl, $b64)) or $reg1\n}\n\nrule Packed_Binary {\n    meta:\n        description = \"Detects potentially packed binary\"\n        author = \"CTI Analyst\"\n    condition:\n        uint16(0) == 0x5A4D and\n        for any section in pe.sections : (\n            section.entropy >= 7.0\n        )\n}\n\"\"\"\n```\n\n### Step 4: Generate STIX 2.1 Indicators\n\n```python\nfrom stix2 import (\n    Bundle, Indicator, Malware, Relationship,\n    File as STIXFile, DomainName, IPv4Address,\n    ObservedData,\n)\nfrom datetime import datetime\n\ndef create_stix_bundle(pe_iocs, string_iocs, yara_results, sample_name):\n    \"\"\"Create STIX 2.1 bundle from extracted IOCs.\"\"\"\n    objects = []\n\n    # Create Malware SDO\n    malware = Malware(\n        name=sample_name,\n        is_family=False,\n        malware_types=[\"unknown\"],\n        description=f\"Malware sample analyzed: {pe_iocs['hashes']['sha256']}\",\n        allow_custom=True,\n    )\n    objects.append(malware)\n\n    # File hash indicator\n    sha256 = pe_iocs[\"hashes\"][\"sha256\"]\n    hash_indicator = Indicator(\n        name=f\"Malware hash: {sha256[:16]}...\",\n        pattern=f\"[file:hashes.'SHA-256' = '{sha256}']\",\n        pattern_type=\"stix\",\n        valid_from=datetime.now().strftime(\"%Y-%m-%dT%H:%M:%SZ\"),\n        indicator_types=[\"malicious-activity\"],\n        allow_custom=True,\n    )\n    objects.append(hash_indicator)\n    objects.append(Relationship(\n        relationship_type=\"indicates\",\n        source_ref=hash_indicator.id,\n        target_ref=malware.id,\n    ))\n\n    # Network indicators from strings\n    for ip in string_iocs.get(\"ipv4\", []):\n        if not ip.startswith((\"10.\", \"172.\", \"192.168.\", \"127.\")):\n            ip_indicator = Indicator(\n                name=f\"C2 IP: {ip}\",\n                pattern=f\"[ipv4-addr:value = '{ip}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now().strftime(\"%Y-%m-%dT%H:%M:%SZ\"),\n                indicator_types=[\"malicious-activity\"],\n                allow_custom=True,\n            )\n            objects.append(ip_indicator)\n            objects.append(Relationship(\n                relationship_type=\"indicates\",\n                source_ref=ip_indicator.id,\n                target_ref=malware.id,\n            ))\n\n    for domain in string_iocs.get(\"domain\", []):\n        domain_indicator = Indicator(\n            name=f\"C2 Domain: {domain}\",\n            pattern=f\"[domain-name:value = '{domain}']\",\n            pattern_type=\"stix\",\n            valid_from=datetime.now().strftime(\"%Y-%m-%dT%H:%M:%SZ\"),\n            indicator_types=[\"malicious-activity\"],\n            allow_custom=True,\n        )\n        objects.append(domain_indicator)\n        objects.append(Relationship(\n            relationship_type=\"indicates\",\n            source_ref=domain_indicator.id,\n            target_ref=malware.id,\n        ))\n\n    bundle = Bundle(objects=objects, allow_custom=True)\n    return bundle\n```\n\n## Validation Criteria\n\n- PE file parsed successfully with hashes, imports, and section analysis\n- String extraction identifies network IOCs (IPs, domains, URLs)\n- YARA rules match against known malware characteristics\n- STIX 2.1 bundle contains valid Indicator and Malware objects\n- Private IP ranges and benign strings filtered from IOC output\n- IOCs are actionable for blocking and detection rule creation\n\n## References\n\n- [pefile Documentation](https:\u002F\u002Fgithub.com\u002Ferocarrera\u002Fpefile)\n- [YARA Documentation](https:\u002F\u002Fyara.readthedocs.io\u002F)\n- [MITRE ATT&CK Software](https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002F)\n- [VirusTotal API](https:\u002F\u002Fdocs.virustotal.com\u002F)\n- [CAPE Sandbox](https:\u002F\u002Fgithub.com\u002Fkevoreilly\u002FCAPEv2)\n- [MalwareBazaar](https:\u002F\u002Fbazaar.abuse.ch\u002F)\n","# Performing Malware IOC Extraction\n\n## Overview\n\nMalware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), registry modifications, mutex names, embedded strings, and behavioral artifacts. This skill covers static analysis with PE parsing and string extraction, dynamic analysis with sandbox detonation, automated IOC extraction using tools like YARA, and formatting results as STIX 2.1 indicators for sharing.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing malware ioc extraction\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `pefile`, `yara-python`, `oletools`, `stix2` libraries\n- Access to malware analysis sandbox (Cuckoo, CAPE, Any.Run, Joe Sandbox)\n- VirusTotal API key for enrichment\n- Isolated analysis environment (VM or container)\n- Understanding of PE file format, common packing techniques\n- Familiarity with YARA rule syntax\n\n## Key Concepts\n\n### Static Analysis IOCs\n- **File Hashes**: MD5, SHA-1, SHA-256 of the sample and any dropped files\n- **Import Hash (imphash)**: Hash of imported function table, groups malware families\n- **Rich Header Hash**: PE rich header hash for compiler fingerprinting\n- **Strings**: Embedded URLs, IP addresses, domain names, registry paths, mutex names\n- **PE Metadata**: Compilation timestamp, section names, resources, digital signatures\n- **Embedded Artifacts**: PDB paths, version info, certificate details\n\n### Dynamic Analysis IOCs\n- **Network Activity**: DNS queries, HTTP requests, TCP\u002FUDP connections, SSL certificates\n- **File System**: Created\u002Fmodified\u002Fdeleted files and directories\n- **Registry**: Created\u002Fmodified registry keys and values\n- **Process**: Spawned processes, injected processes, service creation\n- **Behavioral**: API calls, mutex creation, scheduled tasks, persistence mechanisms\n\n### YARA Rules\nYARA is a pattern-matching tool for identifying and classifying malware. Rules consist of strings (text, hex, regex) and conditions that define matching logic. Rules can detect malware families, packers, exploit kits, and specific campaign tools.\n\n## Workflow\n\n### Step 1: Static Analysis - PE Parsing and Hash Generation\n\n```python\nimport pefile\nimport hashlib\nimport os\n\ndef analyze_pe(filepath):\n    \"\"\"Extract IOCs from a PE file through static analysis.\"\"\"\n    iocs = {\"hashes\": {}, \"pe_info\": {}, \"strings\": [], \"imports\": []}\n\n    # Calculate file hashes\n    with open(filepath, \"rb\") as f:\n        data = f.read()\n    iocs[\"hashes\"][\"md5\"] = hashlib.md5(data).hexdigest()\n    iocs[\"hashes\"][\"sha1\"] = hashlib.sha1(data).hexdigest()\n    iocs[\"hashes\"][\"sha256\"] = hashlib.sha256(data).hexdigest()\n    iocs[\"hashes\"][\"file_size\"] = len(data)\n\n    # Parse PE headers\n    try:\n        pe = pefile.PE(filepath)\n        iocs[\"hashes\"][\"imphash\"] = pe.get_imphash()\n        iocs[\"pe_info\"][\"compilation_time\"] = str(pe.FILE_HEADER.TimeDateStamp)\n        iocs[\"pe_info\"][\"machine_type\"] = hex(pe.FILE_HEADER.Machine)\n        iocs[\"pe_info\"][\"subsystem\"] = pe.OPTIONAL_HEADER.Subsystem\n\n        # Extract sections\n        iocs[\"pe_info\"][\"sections\"] = []\n        for section in pe.sections:\n            iocs[\"pe_info\"][\"sections\"].append({\n                \"name\": section.Name.decode(\"utf-8\", errors=\"ignore\").strip(\"\\x00\"),\n                \"virtual_size\": section.Misc_VirtualSize,\n                \"raw_size\": section.SizeOfRawData,\n                \"entropy\": section.get_entropy(),\n                \"md5\": section.get_hash_md5(),\n            })\n\n        # Extract imports\n        if hasattr(pe, \"DIRECTORY_ENTRY_IMPORT\"):\n            for entry in pe.DIRECTORY_ENTRY_IMPORT:\n                dll_name = entry.dll.decode(\"utf-8\", errors=\"ignore\")\n                functions = [\n                    imp.name.decode(\"utf-8\", errors=\"ignore\")\n                    for imp in entry.imports\n                    if imp.name\n                ]\n                iocs[\"imports\"].append({\"dll\": dll_name, \"functions\": functions})\n\n        # Check for suspicious characteristics\n        iocs[\"pe_info\"][\"is_dll\"] = pe.is_dll()\n        iocs[\"pe_info\"][\"is_driver\"] = pe.is_driver()\n        iocs[\"pe_info\"][\"is_exe\"] = pe.is_exe()\n\n        # Version info\n        if hasattr(pe, \"VS_VERSIONINFO\"):\n            for entry in pe.FileInfo:\n                for st in entry:\n                    for item in st.entries.items():\n                        key = item[0].decode(\"utf-8\", errors=\"ignore\")\n                        val = item[1].decode(\"utf-8\", errors=\"ignore\")\n                        iocs[\"pe_info\"][f\"version_{key}\"] = val\n\n        pe.close()\n\n    except pefile.PEFormatError as e:\n        iocs[\"pe_info\"][\"error\"] = str(e)\n\n    return iocs\n```\n\n### Step 2: String Extraction and IOC Pattern Matching\n\n```python\nimport re\n\ndef extract_ioc_strings(filepath):\n    \"\"\"Extract IOC-relevant strings from binary file.\"\"\"\n    patterns = {\n        \"ipv4\": re.compile(\n            r\"\\b(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}\"\n            r\"(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\b\"\n        ),\n        \"domain\": re.compile(\n            r\"\\b(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+\"\n            r\"(?:com|net|org|io|ru|cn|tk|xyz|top|info|biz|cc|ws|pw)\\b\"\n        ),\n        \"url\": re.compile(\n            r\"https?:\u002F\u002F[^\\s\\\"'\u003C>]{5,200}\"\n        ),\n        \"email\": re.compile(\n            r\"\\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}\\b\"\n        ),\n        \"registry\": re.compile(\n            r\"(?:HKEY_[A-Z_]+|HKLM|HKCU|HKU|HKCR|HKCC)\"\n            r\"\\\\[\\\\a-zA-Z0-9_ .{}-]+\"\n        ),\n        \"filepath_windows\": re.compile(\n            r\"[A-Z]:\\\\(?:[^\\\\\u002F:*?\\\"\u003C>|\\r\\n]+\\\\)*[^\\\\\u002F:*?\\\"\u003C>|\\r\\n]+\"\n        ),\n        \"mutex\": re.compile(\n            r\"(?:Global\\\\|Local\\\\)[a-zA-Z0-9_\\-{}.]{4,}\"\n        ),\n        \"useragent\": re.compile(\n            r\"Mozilla\u002F[45]\\.0[^\\\"']{10,200}\"\n        ),\n        \"bitcoin\": re.compile(\n            r\"\\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\\b\"\n        ),\n        \"pdb_path\": re.compile(\n            r\"[A-Z]:\\\\[^\\\"]{5,200}\\.pdb\"\n        ),\n    }\n\n    with open(filepath, \"rb\") as f:\n        data = f.read()\n\n    # Extract ASCII strings (min length 4)\n    ascii_strings = re.findall(rb\"[\\x20-\\x7e]{4,}\", data)\n    # Extract Unicode strings\n    unicode_strings = re.findall(\n        rb\"(?:[\\x20-\\x7e]\\x00){4,}\", data\n    )\n\n    all_strings = [s.decode(\"ascii\", errors=\"ignore\") for s in ascii_strings]\n    all_strings += [\n        s.decode(\"utf-16-le\", errors=\"ignore\") for s in unicode_strings\n    ]\n\n    extracted = {category: set() for category in patterns}\n\n    for string in all_strings:\n        for category, pattern in patterns.items():\n            matches = pattern.findall(string)\n            for match in matches:\n                extracted[category].add(match)\n\n    # Convert sets to sorted lists\n    return {k: sorted(v) for k, v in extracted.items() if v}\n```\n\n### Step 3: YARA Rule Scanning\n\n```python\nimport yara\n\ndef scan_with_yara(filepath, rules_path):\n    \"\"\"Scan file with YARA rules for malware classification.\"\"\"\n    rules = yara.compile(filepath=rules_path)\n    matches = rules.match(filepath)\n\n    results = []\n    for match in matches:\n        result = {\n            \"rule\": match.rule,\n            \"namespace\": match.namespace,\n            \"tags\": match.tags,\n            \"meta\": match.meta,\n            \"strings\": [],\n        }\n        for offset, identifier, data in match.strings:\n            result[\"strings\"].append({\n                \"offset\": hex(offset),\n                \"identifier\": identifier,\n                \"data\": data.hex() if len(data) \u003C 100 else data[:100].hex() + \"...\",\n            })\n        results.append(result)\n\n    return results\n\n\n# Example YARA rule for common malware indicators\nSAMPLE_YARA_RULE = \"\"\"\nrule Suspicious_Network_Indicators {\n    meta:\n        description = \"Detects suspicious network-related strings\"\n        author = \"CTI Analyst\"\n        severity = \"medium\"\n    strings:\n        $ua1 = \"Mozilla\u002F5.0\" ascii\n        $cmd1 = \"cmd.exe \u002Fc\" ascii nocase\n        $ps1 = \"powershell\" ascii nocase\n        $wget = \"wget\" ascii nocase\n        $curl = \"curl\" ascii nocase\n        $b64 = \"base64\" ascii nocase\n        $reg1 = \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" ascii nocase\n    condition:\n        uint16(0) == 0x5A4D and\n        (2 of ($ua1, $cmd1, $ps1, $wget, $curl, $b64)) or $reg1\n}\n\nrule Packed_Binary {\n    meta:\n        description = \"Detects potentially packed binary\"\n        author = \"CTI Analyst\"\n    condition:\n        uint16(0) == 0x5A4D and\n        for any section in pe.sections : (\n            section.entropy >= 7.0\n        )\n}\n\"\"\"\n```\n\n### Step 4: Generate STIX 2.1 Indicators\n\n```python\nfrom stix2 import (\n    Bundle, Indicator, Malware, Relationship,\n    File as STIXFile, DomainName, IPv4Address,\n    ObservedData,\n)\nfrom datetime import datetime\n\ndef create_stix_bundle(pe_iocs, string_iocs, yara_results, sample_name):\n    \"\"\"Create STIX 2.1 bundle from extracted IOCs.\"\"\"\n    objects = []\n\n    # Create Malware SDO\n    malware = Malware(\n        name=sample_name,\n        is_family=False,\n        malware_types=[\"unknown\"],\n        description=f\"Malware sample analyzed: {pe_iocs['hashes']['sha256']}\",\n        allow_custom=True,\n    )\n    objects.append(malware)\n\n    # File hash indicator\n    sha256 = pe_iocs[\"hashes\"][\"sha256\"]\n    hash_indicator = Indicator(\n        name=f\"Malware hash: {sha256[:16]}...\",\n        pattern=f\"[file:hashes.'SHA-256' = '{sha256}']\",\n        pattern_type=\"stix\",\n        valid_from=datetime.now().strftime(\"%Y-%m-%dT%H:%M:%SZ\"),\n        indicator_types=[\"malicious-activity\"],\n        allow_custom=True,\n    )\n    objects.append(hash_indicator)\n    objects.append(Relationship(\n        relationship_type=\"indicates\",\n        source_ref=hash_indicator.id,\n        target_ref=malware.id,\n    ))\n\n    # Network indicators from strings\n    for ip in string_iocs.get(\"ipv4\", []):\n        if not ip.startswith((\"10.\", \"172.\", \"192.168.\", \"127.\")):\n            ip_indicator = Indicator(\n                name=f\"C2 IP: {ip}\",\n                pattern=f\"[ipv4-addr:value = '{ip}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now().strftime(\"%Y-%m-%dT%H:%M:%SZ\"),\n                indicator_types=[\"malicious-activity\"],\n                allow_custom=True,\n            )\n            objects.append(ip_indicator)\n            objects.append(Relationship(\n                relationship_type=\"indicates\",\n                source_ref=ip_indicator.id,\n                target_ref=malware.id,\n            ))\n\n    for domain in string_iocs.get(\"domain\", []):\n        domain_indicator = Indicator(\n            name=f\"C2 Domain: {domain}\",\n            pattern=f\"[domain-name:value = '{domain}']\",\n            pattern_type=\"stix\",\n            valid_from=datetime.now().strftime(\"%Y-%m-%dT%H:%M:%SZ\"),\n            indicator_types=[\"malicious-activity\"],\n            allow_custom=True,\n        )\n        objects.append(domain_indicator)\n        objects.append(Relationship(\n            relationship_type=\"indicates\",\n            source_ref=domain_indicator.id,\n            target_ref=malware.id,\n        ))\n\n    bundle = Bundle(objects=objects, allow_custom=True)\n    return bundle\n```\n\n## Validation Criteria\n\n- PE file parsed successfully with hashes, imports, and section analysis\n- String extraction identifies network IOCs (IPs, domains, URLs)\n- YARA rules match against known malware characteristics\n- STIX 2.1 bundle contains valid Indicator and Malware objects\n- Private IP ranges and benign strings filtered from IOC output\n- IOCs are actionable for blocking and detection rule creation\n\n## References\n\n- [pefile Documentation](https:\u002F\u002Fgithub.com\u002Ferocarrera\u002Fpefile)\n- [YARA Documentation](https:\u002F\u002Fyara.readthedocs.io\u002F)\n- [MITRE ATT&CK Software](https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002F)\n- [VirusTotal API](https:\u002F\u002Fdocs.virustotal.com\u002F)\n- [CAPE Sandbox](https:\u002F\u002Fgithub.com\u002Fkevoreilly\u002FCAPEv2)\n- [MalwareBazaar](https:\u002F\u002Fbazaar.abuse.ch\u002F)\n",{"name":5,"tags":49,"author":50,"domain":29,"license":15,"version":51,"nist_csf":52,"subdomain":40,"description":7,"mitre_attack":57},[40,39,24,41,28,35,34,42],"mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[58,59,60,61,62],"T1591","T1592","T1593","T1589","T1071","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-malware-ioc-extraction",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-malware-ioc-extraction",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-malware-ioc-extraction",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-malware-ioc-extraction","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002FSKILL.md",true,[87,93,98,104,108,112,118],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",2294,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1720,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",2949,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fworkflows.md",4140,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002Freferences\u002Fworkflows.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fagent.py","SCRIPT","脚本",6191,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002Fscripts\u002Fagent.py",{"path":119,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fprocess.py",16560,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-ioc-extraction\u002Fscripts\u002Fprocess.py",[123,150,174,202,228,255],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":130,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[129],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[131,132,133,134,135,29,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,159,160,135,161,29,138,162,163,164,165,166,167,168,169,170,171,172,173],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[180,183],{"categoryNo":181,"categoryName":182,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[168,185,186,187,188,29,189,190,162,191,192,193,194,195,196,197,198,199,200,201],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[208],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[210,211,212,29,213,214,215,216,217,218,219,220,221,222,223,224,165,225,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,29,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,263,29,264,37,24,265,266,267,268,269,197,270,198,30,271,272,273,274,275],"triaging security incident","siem","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]