reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/writing-a-malware-analysis-report/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/writing-a-malware-analysis-report/SKILL.md

@@ -0,0 +1,115 @@
+---
+name: writing-a-malware-analysis-report
+description: 'Structures a clear, actionable malware analysis report covering summary,
+  sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both
+  technical and decision-making audiences. Activates for requests to write, structure, or
+  review a malware analysis or reverse-engineering report.'
+domain: cybersecurity
+subdomain: lab-foundations
+tags:
+  - malware
+  - reporting
+  - ioc
+  - mitre-attack
+  - documentation
+  - detection
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1587
+d3fend:
+  - D3-FA
+references:
+  - 'MITRE ATT&CK — https://attack.mitre.org/'
+  - 'MISP core format / STIX 2.1 for IOC representation — https://www.misp-project.org/'
+---
+
+# Writing a Malware Analysis Report
+
+## When to Use
+
+- You have completed static, dynamic, or reverse-engineering analysis and need to communicate
+  findings to responders, detection engineers, and leadership.
+- You need a consistent report structure so findings are actionable and comparable across
+  samples.
+- You are reviewing a draft report for completeness before distribution.
+
+**Do not use** this as a substitute for analysis; a report only documents work already done.
+Do not pad a report with tool output that has no analytic conclusion.
+
+## Prerequisites
+
+- Completed analysis artifacts: sample hashes, behavioral notes, extracted IOCs, screenshots,
+  and any reversed routines.
+- An ATT&CK reference for mapping observed behaviors to techniques.
+
+## Workflow
+
+### Step 1: Lead with an executive summary
+
+Three to five sentences a non-analyst can act on: what the sample is, what it does, the risk,
+and the recommended action. State your confidence and the basis for it.
+
+### Step 2: Record sample identity
+
+A table the reader can match against their telemetry:
+
+```text
+Filename (as received) : invoice.exe
+SHA-256                : 9f86d0818...
+SHA-1 / MD5            : ...
+File type / size        : PE32 executable / 412 KB
+First seen / source     : 2026-06-20 / MalwareBazaar
+Signing                 : unsigned / invalid certificate
+```
+
+### Step 3: Describe capabilities, not just events
+
+Group findings by capability (persistence, C2, defense evasion, collection), each with the
+evidence and the ATT&CK technique:
+
+```text
+Persistence  : Run key HKCU\...\Run "Updater" -> %APPDATA%\svc.exe   [T1547.001]
+C2           : HTTPS beacon to evil[.]com/api every 60s +/- jitter   [T1071.001]
+Defense evasion: UPX-packed; checks for VM artifacts before running  [T1027, T1497]
+```
+
+### Step 4: Provide IOCs in a usable form
+
+Defanged for reading, plus a machine-ingestible block (CSV/STIX/MISP) for detection teams.
+Separate **host** IOCs (paths, registry keys, mutexes) from **network** IOCs (domains, IPs,
+URLs, JA3).
+
+### Step 5: Give detection and response guidance
+
+Concrete next steps: YARA/Sigma rules, what to hunt for, containment, and remediation.
+
+### Step 6: Generate the skeleton and validate completeness
+
+```bash
+python scripts/analyst.py scaffold --sha256 <sha256> --name "Sample" > report.md
+python scripts/analyst.py check report.md
+```
+
+## Validation
+
+- An incident responder can act on the report without reading the raw tool logs.
+- Every capability claim cites specific evidence (offset, registry key, packet, decompiled
+  routine).
+- IOCs appear both defanged (for humans) and in a structured block (for tools).
+- ATT&CK techniques are valid current IDs and tied to observed behavior, not guessed.
+
+## Pitfalls
+
+- Dumping raw tool output without interpretation — the reader needs conclusions.
+- Overclaiming attribution ("this is APT-X") from weak signals; state confidence and
+  evidence instead.
+- Mixing host and network IOCs, or leaving IOCs clickable in the human-readable section.
+- Mapping to ATT&CK techniques that the evidence does not actually support.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the scaffold and
+  completeness-check tooling.
+- MITRE ATT&CK and MISP/STIX IOC formats (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/writing-a-malware-analysis-report/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Writing a Malware Analysis Report
+
+## Overview
+
+`scripts/analyst.py` generates a structured Markdown report skeleton and checks a draft for the
+required sections, presence of ATT&CK technique IDs, and accidental clickable URLs.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | Templating, regex, file IO |
+
+## Core functions
+
+### `scaffold(sha256, name)`
+Returns a complete Markdown report template with the standard section order and example
+tables for identity, capabilities, IOCs, and detection.
+
+### `check(text)`
+Returns a list of completeness problems: missing required sections, no ATT&CK IDs, or
+clickable URLs that should be defanged.
+
+## Usage
+
+```bash
+python scripts/analyst.py scaffold --sha256 <sha256> --name "Sample" > report.md
+python scripts/analyst.py check report.md
+```
+
+## Sources
+
+- MITRE ATT&CK technique catalog — https://attack.mitre.org/
+- MISP core format and STIX 2.1 for structured IOC representation —
+  https://www.misp-project.org/
+- Common DFIR reporting structure (executive summary → identity → capabilities → IOCs →
+  detection), standard practice across CERT/IR teams

vendor-new/analyst-ai-pack/skills/writing-a-malware-analysis-report/scripts/analyst.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Malware-report helpers: generate a structured skeleton and check a draft for completeness.
+
+Text-only tooling. ``scaffold`` prints a Markdown report template; ``check`` verifies a draft
+contains the required sections and at least one ATT&CK technique reference.
+"""
+from __future__ import annotations
+
+import argparse
+import datetime as _dt
+import re
+import sys
+from pathlib import Path
+
+REQUIRED_SECTIONS = [
+    "Executive Summary",
+    "Sample Identity",
+    "Capabilities",
+    "Indicators of Compromise",
+    "ATT&CK Mapping",
+    "Detection and Response",
+]
+
+_ATTACK_RE = re.compile(r"\bT\d{4}(\.\d{3})?\b")
+
+
+def scaffold(sha256: str, name: str) -> str:
+    today = _dt.date.today().isoformat()
+    return f"""# Malware Analysis Report: {name}
+
+_Date: {today} · Analyst: <you> · Confidence: <low/medium/high>_
+
+## Executive Summary
+
+<3-5 sentences: what it is, what it does, risk, recommended action.>
+
+## Sample Identity
+
+| Field | Value |
+|---|---|
+| Filename (as received) | <name> |
+| SHA-256 | {sha256} |
+| SHA-1 / MD5 | <...> |
+| File type / size | <...> |
+| First seen / source | {today} / <source> |
+| Signing | <unsigned/invalid/valid> |
+
+## Capabilities
+
+| Capability | Evidence | ATT&CK |
+|---|---|---|
+| Persistence | <evidence> | T1547.001 |
+| Command and Control | <evidence> | T1071.001 |
+| Defense Evasion | <evidence> | T1027 |
+
+## Indicators of Compromise
+
+**Host**
+- <path / registry key / mutex>
+
+**Network (defanged)**
+- hxxps://evil[.]com/api
+
+```csv
+type,value,context
+domain,evil.com,c2
+sha256,{sha256},sample
+```
+
+## ATT&CK Mapping
+
+- T1547.001 — Registry Run Keys
+- T1071.001 — Web Protocols
+
+## Detection and Response
+
+- Detection: <YARA/Sigma summary>
+- Hunt: <what to search for>
+- Containment / remediation: <steps>
+"""
+
+
+def check(text: str) -> list[str]:
+    problems = []
+    for section in REQUIRED_SECTIONS:
+        if section.lower() not in text.lower():
+            problems.append(f"missing section: {section}")
+    if not _ATTACK_RE.search(text):
+        problems.append("no ATT&CK technique IDs found")
+    if "http://" in text or "https://" in text:
+        problems.append("clickable URL present; defang before sharing")
+    return problems
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Malware report helpers")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    p_s = sub.add_parser("scaffold", help="print a report skeleton")
+    p_s.add_argument("--sha256", required=True)
+    p_s.add_argument("--name", required=True)
+
+    p_c = sub.add_parser("check", help="check a draft for completeness")
+    p_c.add_argument("file")
+
+    args = parser.parse_args(argv)
+    if args.cmd == "scaffold":
+        print(scaffold(args.sha256, args.name))
+        return 0
+    problems = check(Path(args.file).read_text(encoding="utf-8", errors="replace"))
+    if problems:
+        for p in problems:
+            print(f"- {p}")
+        return 1
+    print("OK: report contains all required sections and ATT&CK references.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())