reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/measuring-section-entropy-to-detect-packing/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: measuring-section-entropy-to-detect-packing
+description: 'Detects packing and encryption by measuring Shannon entropy across a binary''s
+  sections and regions: flagging high-entropy executable sections, entropy spikes, and
+  size/raw-vs-virtual anomalies that indicate compression or encryption. Activates for requests
+  to measure entropy, detect packing, or assess whether a sample is compressed/encrypted.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - entropy
+  - packing
+  - static-analysis
+  - pe
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027.002
+  - T1027
+d3fend:
+  - D3-FCR
+references:
+  - 'Shannon, A Mathematical Theory of Communication (entropy) — https://doi.org/10.1002/j.1538-7305.1948.tb01338.x'
+  - 'Microsoft PE/COFF specification — https://learn.microsoft.com/windows/win32/debug/pe-format'
+---
+
+# Measuring Section Entropy to Detect Packing
+
+## When to Use
+
+- You want a quick statistical signal of whether a sample is packed or encrypted.
+- You are triaging a PE and need to flag suspicious high-entropy executable sections.
+- You are deciding whether to route a sample to an unpacking workflow.
+
+**Do not use** entropy as a verdict — legitimate compressed resources and installers also show
+high entropy; combine with imports, section names, and raw/virtual size anomalies.
+
+## Prerequisites
+
+- Python (`math` stdlib); optionally `pefile` for per-section analysis.
+
+## Safety & Handling
+
+- Compute entropy on the inert file; never execute the sample.
+- Keep the sample password-protected at rest and reference it by hash.
+
+## Workflow
+
+### Step 1: Compute whole-file and sliding-window entropy
+
+Calculate Shannon entropy (0–8 bits/byte). Sliding-window entropy reveals localized
+high-entropy regions even when the overall value is moderate.
+
+```bash
+python scripts/analyst.py entropy sample.exe
+```
+
+### Step 2: Compute per-section entropy (PE)
+
+For each PE section, compute entropy and compare raw vs. virtual size. Executable sections with
+entropy > ~7.0 are a packing indicator.
+
+### Step 3: Correlate structural anomalies
+
+Flag classic packer signs: high-entropy `.text`, unusual/renamed sections (`UPX0`, random
+names), tiny raw size but large virtual size, and an entry point outside `.text`.
+
+### Step 4: Decide routing
+
+If indicators stack (high entropy + thin IAT + odd sections), route to unpacking; otherwise
+proceed with normal static analysis.
+
+## Validation
+
+- High-entropy executable sections are corroborated by other packing signs before concluding.
+- Benign high-entropy cases (compressed resources) are not misclassified as packers.
+- The routing decision (unpack vs. proceed) is justified by combined indicators.
+
+## Pitfalls
+
+- Calling any high-entropy file "packed" without structural corroboration.
+- Ignoring sliding-window entropy and missing a localized encrypted blob.
+- Overlooking raw-vs-virtual size mismatch, a strong unpacking-at-runtime hint.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the entropy tool.
+- Shannon entropy and the PE/COFF spec (linked in frontmatter).