reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/malware-analysis-claude-skills/CHANGELOG.md

@@ -0,0 +1,90 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/).
+
+## [1.3.0] - 2026-09-05
+
+### Changed
+- **Skills rewritten as agent instructions.** Every phase now tells Claude what to run and interpret on the host instead of guiding a human through it. Each SKILL.md opens with an *Execution Model* (what Claude runs, what is VM-only, what to ask the user for).
+- **malware-triage** — full rewrite: `file` → route, `pe_info.py` interpretation table, ASCII+UTF-16 strings, `ioc_extract.py`, packed-sample handling, unknown-file carving (XOR/base64/gzip), batch mode, state-file output.
+- **malware-dynamic-analysis** — split into Part A (VM runbook for the analyst, tailored from triage predictions, ending in text-format export commands: Procmon CSV, Sysmon JSON, tshark, autoruns, dropped files) and Part B (Claude parses the evidence: process tree, injection, persistence, C2/beaconing, dropped files, memory strings, sandbox reports). Binary-evidence conversion table added.
+- **specialized-file-analyzer** — host-first workflows: `ilspycmd` decompilation with grep patterns, Python static decoders for PowerShell (`-EncodedCommand`, gzip), VBScript (Chr/Replace/StrReverse), JS escapes; PSDecode / `cscript` / `strace` / dnSpy marked VM-only.
+- **detection-engineer** — derives rules from the evidence files, writes them to `detections/`, runs `sigma check` / `suricata -T` when available, uses `ioc_extract.py` for defanging and export.
+- **malware-report-writer** — reads `analysis_state.md` and evidence instead of asking for findings; authors and `yara`-tests the rule; writes `reports/<sample>_report.md`.
+- **Orchestrator** — Execution Model, bundled-script table, host tool check, runbook-based VM boundary, sub-skill path note.
+- **README** — real install instructions (`git clone` into `~/.claude/skills/`, only the orchestrator registers), updated CAN/CANNOT, compact sub-skill table, evidence-driven usage example.
+
+### Added
+- **Claude Code plugin packaging** — `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`. Install with `/plugin marketplace add gl0bal01/malware-analysis-claude-skills` then `/plugin install malware-analysis`. Only the orchestrator registers as a skill; sub-skills load by path. Skills resolve their files via `$CLAUDE_PLUGIN_ROOT` (plugin) or the skill directory (git clone).
+- **Test harness + CI** — `tests/run.sh` (8 stages), `tests/make_pe.py` (deterministic benign PE fixture), `tests/fixtures/` (Procmon/Sysmon/tshark evidence, obfuscated scripts, YARA rule), `tests/extract_rules.py`; `.github/workflows/test.yml` runs it on push/PR. Core runs stdlib-only; optional tool checks (pefile/yara/sigma) skip gracefully.
+- **`docs/example-triage.md`** — a real, unedited autonomous triage transcript produced by Claude running the skill headless against the fixture.
+- `malware-dynamic-analysis/scripts/procmon_summary.py` — Procmon CSV → process tree, file/registry writes (persistence flagged), network, non-system image loads; scoped to a process and its descendants.
+- `malware-dynamic-analysis/scripts/sysmon_summary.py` — Sysmon (PowerShell JSON/CSV or `evtx_dump` JSONL) → tree, network with beacon-interval detection, DNS, files, registry, remote threads, process access, pipes, WMI, tampering.
+- Both readers accept UTF-16 (PowerShell 5.1 default) and UTF-8; both have `--self-test`.
+
+### Removed
+- `Quick_Start.md` (subset of README with incorrect install steps).
+- Duplicated "Report Quality Checklist" from `best_practices.md` (kept in the report-writer SKILL.md) and the human-oriented "Time Management" section from the report-writer SKILL.md.
+
+## [1.2.0] - 2026-04-12
+
+### Added
+- **`.gitignore`** — ignores `.omc/`, analysis state files, binary evidence formats
+- **`sandbox_setup.md`** — REMnux/FlareVM setup, network isolation, snapshot management, VM detection countermeasures
+- **`anti_analysis_bypass.md`** — anti-analysis techniques (ETW, AMSI, syscalls, PPID spoofing, module stomping), bypass strategies, MITRE ATT&CK mapping
+- **HTA and disk image analysis** — full coverage in `specialized-file-analyzer` for HTA files (T1218.005) and ISO/IMG/VHD/VHDX (T1553.005)
+- **HTA/ISO/VHD routing** in orchestrator file type priority order
+- **Packed sample handling** in `malware-triage` — packer detection, UPX unpacking, entropy analysis
+- **Modern evasion techniques** in `indicators.md` — ETW patching, AMSI bypass, direct syscalls, PPID spoofing, module stomping, callback-based execution
+- **VBScript deobfuscation** expanded in `specialized-file-analyzer` — Chr() resolution, Execute/ExecuteGlobal extraction, StrReverse, Replace chains
+- **Defanging guidance** added to `malware-report-writer` SKILL.md and report template
+- **Modern PDF CVEs** — CVE-2023-21608, CVE-2023-26369, CVE-2024-4367, CVE-2023-36664
+
+### Fixed
+- **AMSI bypass return values** corrected to match Windows SDK (AMSI_RESULT_CLEAN = 0)
+- **`CreateScheduledTask`** replaced with correct APIs (`ITaskService`/`ITaskFolder::RegisterTaskDefinition`)
+- **x64dbg sleep-patch script** — fixed label syntax and double `run` logic
+- **Un-defanged IP** in `best_practices.md` good example
+- **MCP package name** inconsistency (`@anthropic-ai` → `@burtthecoder`) in quick setup
+- **Placeholder Sigma UUIDs** replaced with real UUID4s to prevent copy-paste into production
+- **`hash_calculator.py`** exception handling tightened to specific I/O errors
+- **Suricata Example 1** updated to modern sticky buffer syntax (`http.method`, `http.uri`)
+
+### Changed
+- **Process Hacker → System Informer** across all files (renamed 2022)
+- **Ubuntu 20.04 → 22.04 LTS** in sandbox setup (20.04 EOL)
+- **peepdf → peepdf-3** install instructions (Python 3 fork)
+- **sigmac → sigma-cli** as primary tool reference
+- **README.md** trimmed from 990 to 349 lines — removed redundant sections
+- **YARA ownership** clarified in `detection-engineer` with explicit note
+- **Sigma template** in report template completed with required fields (id, status, author, date, tags)
+- **Frontmatter** standardized across all 6 SKILL.md files
+- Removed orphan `malware-triage/test.txt`
+
+## [1.1.0] - 2026-03-15
+
+### Added
+- **Orchestrator skill** (`SKILL.md` at repo root) — single entry point that routes to the 5 sub-skills based on file type and user intent
+- **Analysis state tracking** — `analysis_state.md` file carries findings, IOCs, and phase status across the full analysis lifecycle
+- **Multi-sample batch workflow** — triage all samples first, rank by priority, then deep-analyze high-priority samples sequentially
+- **Suggest-next mode** — orchestrator recommends the next phase with reasoning after each phase completes, waits for user confirmation
+- **Edge case handling** — benign sample detection, unrecognized file types, state file conflict resolution, skill repo directory guard
+- **MCP server integration guide** (`references/mcp_integrations.md`) — maps 6 MCP servers (VirusTotal, Threat.Zone, Threat Intel, MISP, Shodan, Volatility) to skills with setup instructions
+- `CHANGELOG.md`
+
+### Changed
+- Updated `CLAUDE.md` to document the orchestrator and cross-skill routing boundaries
+- Updated `README.md` to reflect orchestrator as the primary entry point
+- Updated `Quick_Start.md` with simplified orchestrator-based workflow
+
+## [1.0.0] - 2025-10-26
+
+### Added
+- **malware-triage** — rapid sample assessment, classification, and prioritization
+- **malware-dynamic-analysis** — safe execution and behavior monitoring in isolated VMs
+- **specialized-file-analyzer** — non-PE file analysis (.NET, Office, PDF, scripts, archives, LNK, ELF)
+- **detection-engineer** — Sigma rules, Suricata rules, hunting queries, IOC defanging
+- **malware-report-writer** — professional report creation with 12-section template and YARA rules
+- GitHub Actions workflow for Codeberg mirroring