# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/).

## [1.3.0] - 2026-09-05

### Changed
- **Skills rewritten as agent instructions.** Every phase now tells Claude what to run and interpret on the host instead of guiding a human through it. Each SKILL.md opens with an *Execution Model* (what Claude runs, what is VM-only, what to ask the user for).
- **malware-triage** — full rewrite: `file` → route, `pe_info.py` interpretation table, ASCII+UTF-16 strings, `ioc_extract.py`, packed-sample handling, unknown-file carving (XOR/base64/gzip), batch mode, state-file output.
- **malware-dynamic-analysis** — split into Part A (VM runbook for the analyst, tailored from triage predictions, ending in text-format export commands: Procmon CSV, Sysmon JSON, tshark, autoruns, dropped files) and Part B (Claude parses the evidence: process tree, injection, persistence, C2/beaconing, dropped files, memory strings, sandbox reports). Binary-evidence conversion table added.
- **specialized-file-analyzer** — host-first workflows: `ilspycmd` decompilation with grep patterns, Python static decoders for PowerShell (`-EncodedCommand`, gzip), VBScript (Chr/Replace/StrReverse), JS escapes; PSDecode / `cscript` / `strace` / dnSpy marked VM-only.
- **detection-engineer** — derives rules from the evidence files, writes them to `detections/`, runs `sigma check` / `suricata -T` when available, uses `ioc_extract.py` for defanging and export.
- **malware-report-writer** — reads `analysis_state.md` and evidence instead of asking for findings; authors and `yara`-tests the rule; writes `reports/<sample>_report.md`.
- **Orchestrator** — Execution Model, bundled-script table, host tool check, runbook-based VM boundary, sub-skill path note.
- **README** — real install instructions (`git clone` into `~/.claude/skills/`, only the orchestrator registers), updated CAN/CANNOT, compact sub-skill table, evidence-driven usage example.

### Added
- **Claude Code plugin packaging** — `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`. Install with `/plugin marketplace add gl0bal01/malware-analysis-claude-skills` then `/plugin install malware-analysis`. Only the orchestrator registers as a skill; sub-skills load by path. Skills resolve their files via `$CLAUDE_PLUGIN_ROOT` (plugin) or the skill directory (git clone).
- **Test harness + CI** — `tests/run.sh` (8 stages), `tests/make_pe.py` (deterministic benign PE fixture), `tests/fixtures/` (Procmon/Sysmon/tshark evidence, obfuscated scripts, YARA rule), `tests/extract_rules.py`; `.github/workflows/test.yml` runs it on push/PR. Core runs stdlib-only; optional tool checks (pefile/yara/sigma) skip gracefully.
- **`docs/example-triage.md`** — a real, unedited autonomous triage transcript produced by Claude running the skill headless against the fixture.
- `malware-dynamic-analysis/scripts/procmon_summary.py` — Procmon CSV → process tree, file/registry writes (persistence flagged), network, non-system image loads; scoped to a process and its descendants.
- `malware-dynamic-analysis/scripts/sysmon_summary.py` — Sysmon (PowerShell JSON/CSV or `evtx_dump` JSONL) → tree, network with beacon-interval detection, DNS, files, registry, remote threads, process access, pipes, WMI, tampering.
- Both readers accept UTF-16 (PowerShell 5.1 default) and UTF-8; both have `--self-test`.

### Removed
- `Quick_Start.md` (subset of README with incorrect install steps).
- Duplicated "Report Quality Checklist" from `best_practices.md` (kept in the report-writer SKILL.md) and the human-oriented "Time Management" section from the report-writer SKILL.md.

## [1.2.0] - 2026-04-12

### Added
- **`.gitignore`** — ignores `.omc/`, analysis state files, binary evidence formats
- **`sandbox_setup.md`** — REMnux/FlareVM setup, network isolation, snapshot management, VM detection countermeasures
- **`anti_analysis_bypass.md`** — anti-analysis techniques (ETW, AMSI, syscalls, PPID spoofing, module stomping), bypass strategies, MITRE ATT&CK mapping
- **HTA and disk image analysis** — full coverage in `specialized-file-analyzer` for HTA files (T1218.005) and ISO/IMG/VHD/VHDX (T1553.005)
- **HTA/ISO/VHD routing** in orchestrator file type priority order
- **Packed sample handling** in `malware-triage` — packer detection, UPX unpacking, entropy analysis
- **Modern evasion techniques** in `indicators.md` — ETW patching, AMSI bypass, direct syscalls, PPID spoofing, module stomping, callback-based execution
- **VBScript deobfuscation** expanded in `specialized-file-analyzer` — Chr() resolution, Execute/ExecuteGlobal extraction, StrReverse, Replace chains
- **Defanging guidance** added to `malware-report-writer` SKILL.md and report template
- **Modern PDF CVEs** — CVE-2023-21608, CVE-2023-26369, CVE-2024-4367, CVE-2023-36664

### Fixed
- **AMSI bypass return values** corrected to match Windows SDK (AMSI_RESULT_CLEAN = 0)
- **`CreateScheduledTask`** replaced with correct APIs (`ITaskService`/`ITaskFolder::RegisterTaskDefinition`)
- **x64dbg sleep-patch script** — fixed label syntax and double `run` logic
- **Un-defanged IP** in `best_practices.md` good example
- **MCP package name** inconsistency (`@anthropic-ai` → `@burtthecoder`) in quick setup
- **Placeholder Sigma UUIDs** replaced with real UUID4s to prevent copy-paste into production
- **`hash_calculator.py`** exception handling tightened to specific I/O errors
- **Suricata Example 1** updated to modern sticky buffer syntax (`http.method`, `http.uri`)

### Changed
- **Process Hacker → System Informer** across all files (renamed 2022)
- **Ubuntu 20.04 → 22.04 LTS** in sandbox setup (20.04 EOL)
- **peepdf → peepdf-3** install instructions (Python 3 fork)
- **sigmac → sigma-cli** as primary tool reference
- **README.md** trimmed from 990 to 349 lines — removed redundant sections
- **YARA ownership** clarified in `detection-engineer` with explicit note
- **Sigma template** in report template completed with required fields (id, status, author, date, tags)
- **Frontmatter** standardized across all 6 SKILL.md files
- Removed orphan `malware-triage/test.txt`

## [1.1.0] - 2026-03-15

### Added
- **Orchestrator skill** (`SKILL.md` at repo root) — single entry point that routes to the 5 sub-skills based on file type and user intent
- **Analysis state tracking** — `analysis_state.md` file carries findings, IOCs, and phase status across the full analysis lifecycle
- **Multi-sample batch workflow** — triage all samples first, rank by priority, then deep-analyze high-priority samples sequentially
- **Suggest-next mode** — orchestrator recommends the next phase with reasoning after each phase completes, waits for user confirmation
- **Edge case handling** — benign sample detection, unrecognized file types, state file conflict resolution, skill repo directory guard
- **MCP server integration guide** (`references/mcp_integrations.md`) — maps 6 MCP servers (VirusTotal, Threat.Zone, Threat Intel, MISP, Shodan, Volatility) to skills with setup instructions
- `CHANGELOG.md`

### Changed
- Updated `CLAUDE.md` to document the orchestrator and cross-skill routing boundaries
- Updated `README.md` to reflect orchestrator as the primary entry point
- Updated `Quick_Start.md` with simplified orchestrator-based workflow

## [1.0.0] - 2025-10-26

### Added
- **malware-triage** — rapid sample assessment, classification, and prioritization
- **malware-dynamic-analysis** — safe execution and behavior monitoring in isolated VMs
- **specialized-file-analyzer** — non-PE file analysis (.NET, Office, PDF, scripts, archives, LNK, ELF)
- **detection-engineer** — Sigma rules, Suricata rules, hunting queries, IOC defanging
- **malware-report-writer** — professional report creation with 12-section template and YARA rules
- GitHub Actions workflow for Codeberg mirroring