API Reference: Writing a Malware Analysis Report

Overview

scripts/analyst.py generates a structured Markdown report skeleton and checks a draft for the required sections, presence of ATT&CK technique IDs, and accidental clickable URLs.

Dependencies

Package	Version	Purpose
(stdlib)	—	Templating, regex, file IO

Core functions

`scaffold(sha256, name)`

Returns a complete Markdown report template with the standard section order and example tables for identity, capabilities, IOCs, and detection.

`check(text)`

Returns a list of completeness problems: missing required sections, no ATT&CK IDs, or clickable URLs that should be defanged.

Usage

python scripts/analyst.py scaffold --sha256 <sha256> --name "Sample" > report.md
python scripts/analyst.py check report.md

Sources

MITRE ATT&CK technique catalog — https://attack.mitre.org/
MISP core format and STIX 2.1 for structured IOC representation — https://www.misp-project.org/
Common DFIR reporting structure (executive summary → identity → capabilities → IOCs → detection), standard practice across CERT/IR teams

1.2 KiB Raw Blame History