vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/vendor-new/malware-analysis-claude-skills/CHANGELOG.md

7.9 KiB
Raw Permalink Blame History

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[1.3.0] - 2026-09-05

Changed

  • Skills rewritten as agent instructions. Every phase now tells Claude what to run and interpret on the host instead of guiding a human through it. Each SKILL.md opens with an Execution Model (what Claude runs, what is VM-only, what to ask the user for).
  • malware-triage — full rewrite: file → route, pe_info.py interpretation table, ASCII+UTF-16 strings, ioc_extract.py, packed-sample handling, unknown-file carving (XOR/base64/gzip), batch mode, state-file output.
  • malware-dynamic-analysis — split into Part A (VM runbook for the analyst, tailored from triage predictions, ending in text-format export commands: Procmon CSV, Sysmon JSON, tshark, autoruns, dropped files) and Part B (Claude parses the evidence: process tree, injection, persistence, C2/beaconing, dropped files, memory strings, sandbox reports). Binary-evidence conversion table added.
  • specialized-file-analyzer — host-first workflows: ilspycmd decompilation with grep patterns, Python static decoders for PowerShell (-EncodedCommand, gzip), VBScript (Chr/Replace/StrReverse), JS escapes; PSDecode / cscript / strace / dnSpy marked VM-only.
  • detection-engineer — derives rules from the evidence files, writes them to detections/, runs sigma check / suricata -T when available, uses ioc_extract.py for defanging and export.
  • malware-report-writer — reads analysis_state.md and evidence instead of asking for findings; authors and yara-tests the rule; writes reports/<sample>_report.md.
  • Orchestrator — Execution Model, bundled-script table, host tool check, runbook-based VM boundary, sub-skill path note.
  • README — real install instructions (git clone into ~/.claude/skills/, only the orchestrator registers), updated CAN/CANNOT, compact sub-skill table, evidence-driven usage example.

Added

  • Claude Code plugin packaging — .claude-plugin/plugin.json and .claude-plugin/marketplace.json. Install with /plugin marketplace add gl0bal01/malware-analysis-claude-skills then /plugin install malware-analysis. Only the orchestrator registers as a skill; sub-skills load by path. Skills resolve their files via $CLAUDE_PLUGIN_ROOT (plugin) or the skill directory (git clone).
  • Test harness + CI — tests/run.sh (8 stages), tests/make_pe.py (deterministic benign PE fixture), tests/fixtures/ (Procmon/Sysmon/tshark evidence, obfuscated scripts, YARA rule), tests/extract_rules.py; .github/workflows/test.yml runs it on push/PR. Core runs stdlib-only; optional tool checks (pefile/yara/sigma) skip gracefully.
  • docs/example-triage.md — a real, unedited autonomous triage transcript produced by Claude running the skill headless against the fixture.
  • malware-dynamic-analysis/scripts/procmon_summary.py — Procmon CSV → process tree, file/registry writes (persistence flagged), network, non-system image loads; scoped to a process and its descendants.
  • malware-dynamic-analysis/scripts/sysmon_summary.py — Sysmon (PowerShell JSON/CSV or evtx_dump JSONL) → tree, network with beacon-interval detection, DNS, files, registry, remote threads, process access, pipes, WMI, tampering.
  • Both readers accept UTF-16 (PowerShell 5.1 default) and UTF-8; both have --self-test.

Removed

  • Quick_Start.md (subset of README with incorrect install steps).
  • Duplicated "Report Quality Checklist" from best_practices.md (kept in the report-writer SKILL.md) and the human-oriented "Time Management" section from the report-writer SKILL.md.

[1.2.0] - 2026-04-12

Added

  • .gitignore — ignores .omc/, analysis state files, binary evidence formats
  • sandbox_setup.md — REMnux/FlareVM setup, network isolation, snapshot management, VM detection countermeasures
  • anti_analysis_bypass.md — anti-analysis techniques (ETW, AMSI, syscalls, PPID spoofing, module stomping), bypass strategies, MITRE ATT&CK mapping
  • HTA and disk image analysis — full coverage in specialized-file-analyzer for HTA files (T1218.005) and ISO/IMG/VHD/VHDX (T1553.005)
  • HTA/ISO/VHD routing in orchestrator file type priority order
  • Packed sample handling in malware-triage — packer detection, UPX unpacking, entropy analysis
  • Modern evasion techniques in indicators.md — ETW patching, AMSI bypass, direct syscalls, PPID spoofing, module stomping, callback-based execution
  • VBScript deobfuscation expanded in specialized-file-analyzer — Chr() resolution, Execute/ExecuteGlobal extraction, StrReverse, Replace chains
  • Defanging guidance added to malware-report-writer SKILL.md and report template
  • Modern PDF CVEs — CVE-2023-21608, CVE-2023-26369, CVE-2024-4367, CVE-2023-36664

Fixed

  • AMSI bypass return values corrected to match Windows SDK (AMSI_RESULT_CLEAN = 0)
  • CreateScheduledTask replaced with correct APIs (ITaskService/ITaskFolder::RegisterTaskDefinition)
  • x64dbg sleep-patch script — fixed label syntax and double run logic
  • Un-defanged IP in best_practices.md good example
  • MCP package name inconsistency (@anthropic-ai → @burtthecoder) in quick setup
  • Placeholder Sigma UUIDs replaced with real UUID4s to prevent copy-paste into production
  • hash_calculator.py exception handling tightened to specific I/O errors
  • Suricata Example 1 updated to modern sticky buffer syntax (http.method, http.uri)

Changed

  • Process Hacker → System Informer across all files (renamed 2022)
  • Ubuntu 20.04 → 22.04 LTS in sandbox setup (20.04 EOL)
  • peepdf → peepdf-3 install instructions (Python 3 fork)
  • sigmac → sigma-cli as primary tool reference
  • README.md trimmed from 990 to 349 lines — removed redundant sections
  • YARA ownership clarified in detection-engineer with explicit note
  • Sigma template in report template completed with required fields (id, status, author, date, tags)
  • Frontmatter standardized across all 6 SKILL.md files
  • Removed orphan malware-triage/test.txt

[1.1.0] - 2026-03-15

Added

  • Orchestrator skill (SKILL.md at repo root) — single entry point that routes to the 5 sub-skills based on file type and user intent
  • Analysis state tracking — analysis_state.md file carries findings, IOCs, and phase status across the full analysis lifecycle
  • Multi-sample batch workflow — triage all samples first, rank by priority, then deep-analyze high-priority samples sequentially
  • Suggest-next mode — orchestrator recommends the next phase with reasoning after each phase completes, waits for user confirmation
  • Edge case handling — benign sample detection, unrecognized file types, state file conflict resolution, skill repo directory guard
  • MCP server integration guide (references/mcp_integrations.md) — maps 6 MCP servers (VirusTotal, Threat.Zone, Threat Intel, MISP, Shodan, Volatility) to skills with setup instructions
  • CHANGELOG.md

Changed

  • Updated CLAUDE.md to document the orchestrator and cross-skill routing boundaries
  • Updated README.md to reflect orchestrator as the primary entry point
  • Updated Quick_Start.md with simplified orchestrator-based workflow

[1.0.0] - 2025-10-26

Added

  • malware-triage — rapid sample assessment, classification, and prioritization
  • malware-dynamic-analysis — safe execution and behavior monitoring in isolated VMs
  • specialized-file-analyzer — non-PE file analysis (.NET, Office, PDF, scripts, archives, LNK, ELF)
  • detection-engineer — Sigma rules, Suricata rules, hunting queries, IOC defanging
  • malware-report-writer — professional report creation with 12-section template and YARA rules
  • GitHub Actions workflow for Codeberg mirroring