reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: analyzing-wiper-malware
+description: 'Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite
+  primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and
+  distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify
+  destructive disk-overwrite behavior, or tell a wiper apart from ransomware.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - wiper
+  - destructive
+  - mbr
+  - impact
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1485
+  - T1561.002
+  - T1561.001
+d3fend:
+  - D3-PSA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1561 Disk Wipe — https://attack.mitre.org/techniques/T1561/'
+  - 'MITRE ATT&CK T1485 Data Destruction — https://attack.mitre.org/techniques/T1485/'
+---
+
+# Analyzing Wiper Malware
+
+## When to Use
+
+- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
+  tampering, and mass-deletion primitives.
+- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).
+
+**Do not use** this on a live host or by running the sample — destructive behavior is the threat.
+Analyze statically in isolation.
+
+## Prerequisites
+
+- The sample, read inertly.
+
+## Safety & Handling
+
+- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.
+
+## Workflow
+
+### Step 1: Detect destructive primitives
+
+```bash
+python scripts/analyst.py scan sample.bin
+```
+
+Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns,
+`CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops.
+
+### Step 2: Detect backup/recovery destruction
+
+Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and
+`wevtutil cl` (log clearing) — common wiper recovery-denial steps.
+
+### Step 3: Distinguish wiper vs ransomware
+
+Weigh destruction-without-crypto and absence of a ransom note / key exchange against
+encryption-and-extortion indicators to classify intent.
+
+### Step 4: Document
+
+Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.
+
+## Validation
+
+- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
+- Recovery-denial commands are detected where present.
+- The wiper-vs-ransomware classification cites concrete evidence.
+
+## Pitfalls
+
+- Disk utilities and secure-erase tools share these primitives — context is essential.
+- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
+- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
+- ATT&CK T1561 and T1485 (linked in frontmatter).