reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/monitoring-process-and-file-behavior/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/monitoring-process-and-file-behavior/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: monitoring-process-and-file-behavior
+description: 'Summarizes runtime behavior of a sample from Procmon-style operation logs — process
+  and thread creation, file and registry writes, and network-related operations — to build a
+  behavioral profile. Activates for requests to analyze Procmon output, summarize sample behavior,
+  or profile process/file/registry activity from a sandbox run.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - dynamic-analysis
+  - procmon
+  - behavioral
+  - sandbox
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1106
+  - T1112
+  - T1059
+d3fend:
+  - D3-PSA
+  - D3-FAPA
+car:
+  - CAR-2013-05-002
+references:
+  - 'MITRE ATT&CK T1106 Native API — https://attack.mitre.org/techniques/T1106/'
+  - 'Sysinternals Process Monitor — https://learn.microsoft.com/sysinternals/downloads/procmon'
+---
+
+# Monitoring Process and File Behavior
+
+## When to Use
+
+- You have a Procmon CSV/XML export (or equivalent sandbox operation log) from detonating a sample.
+- You need a concise behavioral profile: child processes, file writes, registry persistence,
+  and network-related calls.
+- You are correlating dynamic behavior with static indicators.
+
+**Do not use** this to detonate the sample yourself — it consumes already-captured logs. Run the
+sample only inside an isolated, instrumented sandbox you own.
+
+## Prerequisites
+
+- A Procmon CSV export (or comparable operation log) from an isolated detonation.
+
+## Safety & Handling
+
+- Only consume logs; never execute the sample on an analyst workstation.
+- Defang any captured URLs/hosts before sharing.
+
+## Workflow
+
+### Step 1: Summarize operations by category
+
+```bash
+python scripts/analyst.py summarize procmon.csv
+```
+
+Counts operations by class (Process/Thread, File, Registry, Network) and lists the busiest paths.
+
+### Step 2: Identify process tree
+
+Extract `Process Create` events to reconstruct parent/child relationships and command lines —
+LOLBins (`powershell`, `rundll32`, `mshta`) spawned from the sample are high-signal.
+
+### Step 3: Identify persistence and drops
+
+Registry writes under `Run`/`RunOnce`/services, and file writes to `%APPDATA%`/`%TEMP%`/startup,
+indicate persistence and staged payloads.
+
+### Step 4: Build the behavioral profile
+
+Map observed operations to ATT&CK techniques and defang any network endpoints.
+
+## Validation
+
+- The process tree reconstructs from `Process Create` events.
+- File and registry writes are categorized with their target paths.
+- Observed behaviors map to specific ATT&CK techniques.
+
+## Pitfalls
+
+- Treating noisy read operations as significant — writes and creates carry the signal.
+- Missing short-lived child processes that exited before capture stopped.
+- Ignoring path normalization (`%TEMP%` vs absolute) when deduplicating.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the summarizer.
+- ATT&CK T1106 and Process Monitor docs (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/monitoring-process-and-file-behavior/references/api-reference.md

@@ -0,0 +1,36 @@
+# API Reference: Monitoring Process and File Behavior
+
+## Overview
+
+`scripts/analyst.py` parses a Process Monitor CSV export, categorizes operations
+(process/thread, file, registry, network), reconstructs Process Create events, flags
+persistence-relevant writes, and defangs URLs. It parses logs only and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | csv, regex, Counter, JSON |
+
+## Core functions
+
+### `summarize(path)`
+Returns operation category counts, process creates, LOLBin children, persistence writes, and
+defanged URLs.
+
+## Expected CSV columns
+
+`Process Name`, `Operation`, `Path`, `Detail` (Procmon "Save As → CSV" defaults). UTF-8 BOM is
+handled via `utf-8-sig`.
+
+## Usage
+
+```bash
+python scripts/analyst.py summarize procmon.csv
+```
+
+## Sources
+
+- MITRE ATT&CK T1106 Native API — https://attack.mitre.org/techniques/T1106/
+- Sysinternals Process Monitor — https://learn.microsoft.com/sysinternals/downloads/procmon
+- Run/RunOnce/services persistence locations, Windows registry documentation

vendor-new/analyst-ai-pack/skills/monitoring-process-and-file-behavior/scripts/analyst.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Summarize a Procmon-style CSV operation log into a behavioral profile.
+
+Reads a CSV export (Process Monitor "Save as CSV") with at least Process Name, Operation, Path,
+and Detail columns. Categorizes operations, reconstructs the process tree from Process Create
+events, and highlights persistence-relevant writes. Parses logs only; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import re
+import sys
+from collections import Counter
+
+PERSIST_HINTS = ["\\run", "\\runonce", "currentversion\\run", "\\services\\", "startup"]
+LOLBINS = ["powershell", "rundll32", "mshta", "regsvr32", "wscript", "cscript", "cmd.exe",
+           "certutil", "bitsadmin"]
+RE_URL = re.compile(r"https?://[^\s\"'<>]+", re.I)
+
+
+def _category(op: str) -> str:
+    op = op.lower()
+    if "process" in op or "thread" in op:
+        return "process_thread"
+    if "reg" in op:
+        return "registry"
+    if "tcp" in op or "udp" in op or "connect" in op:
+        return "network"
+    if "file" in op or "create" in op or "write" in op or "read" in op:
+        return "file"
+    return "other"
+
+
+def summarize(path: str) -> dict:
+    cats: Counter = Counter()
+    children = []
+    persistence = []
+    urls = set()
+    with open(path, newline="", encoding="utf-8-sig", errors="replace") as fh:
+        reader = csv.DictReader(fh)
+        for row in reader:
+            op = row.get("Operation", "")
+            target = row.get("Path", "")
+            detail = row.get("Detail", "")
+            cats[_category(op)] += 1
+            if op.lower().startswith("process create"):
+                children.append({"parent": row.get("Process Name", ""), "detail": detail})
+            low = target.lower()
+            if any(h in low for h in PERSIST_HINTS) and "write" in op.lower():
+                persistence.append({"op": op, "path": target})
+            for u in RE_URL.findall(detail) + RE_URL.findall(target):
+                urls.add(u)
+    return {
+        "operation_categories": dict(cats),
+        "process_creates": children[:50],
+        "lolbin_children": sorted({b for c in children for b in LOLBINS
+                                   if b in c["detail"].lower()}),
+        "persistence_writes": persistence[:50],
+        "urls": sorted(u.replace("http", "hxxp").replace(".", "[.]") for u in urls),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Summarize Procmon CSV behavior")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("summarize")
+    p.add_argument("csv")
+    args = parser.parse_args(argv)
+    print(json.dumps(summarize(args.csv), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())