[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AMSHE9WAMNWDA5ZPWEZ9Y":3,"skill-same:01M71AMSHE9WAMNWDA5ZPWEZ9Y":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71AMSHE9WAMNWDA5ZPWEZ9Y","cyber-building-malware-incident-communication-template",null,"Build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-building-malware-incident-communication-template\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"incident","communication","template","malware","cyber building malware incident communication template","building malware incident communication template","crisis","severity","domain","escalation","subdomain","notifications","false","cybersecurity","briefing","executive-briefing","crisis-communication","stakeholder-notification","malware-response","incident-communication","2026-11-10 10:12:30",false,"---\nname: cyber-building-malware-incident-communication-template\ndescription: \"Build structured communication templates for malware incidents including stakeholder notifications, executive briefings, technical advisories, and regulatory disclosures with severity-based escalation procedures.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: building-malware-incident-communication-template | description: Build structured communication templates for malware incidents including |   stakeholder notifications, executive briefings, technical advisories, and regulatory |   disclosures with severity-based escalation procedures. | domain: cybersecurity | subdomain: incident-response | tags: | - incident-communication | - malware-response | - stakeholder-notification | - crisis-communication | - executive-briefing | - regulatory-disclo\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Building Malware Incident Communication Template\n\n## Overview\n\nEffective communication during malware incidents is critical for coordinated response, stakeholder management, and regulatory compliance. A structured communication framework ensures the right people receive appropriate information at the right time, preventing panic while maintaining transparency. Communication templates should cover internal escalation, executive briefings, technical advisories for IT teams, customer notifications, regulatory disclosures, and media statements. The framework must account for different malware types (ransomware, wiper, trojan, worm) and severity levels that drive escalation speed and audience.\n\n\n## When to Use\n\n- When deploying or configuring building malware incident communication template capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Communication Framework\n\n### Severity Classification\n\n| Severity | Description | Notification Timeline | Audience |\n|----------|-------------|----------------------|----------|\n| P1 - Critical | Ransomware, wiper, or widespread infection affecting business operations | Within 15 minutes | CISO, CEO, Legal, Board (if applicable) |\n| P2 - High | Targeted malware on critical systems, data exfiltration suspected | Within 1 hour | CISO, IT Director, Legal |\n| P3 - Medium | Contained malware infection, limited spread | Within 4 hours | Security Manager, IT Director |\n| P4 - Low | Single endpoint infection, quickly contained | Within 24 hours | Security Team Lead |\n\n### Communication Channels\n\n| Channel | Use Case | Security Level |\n|---------|----------|---------------|\n| Out-of-band phone calls | Initial critical notifications | Highest |\n| Encrypted messaging (Signal) | Real-time IR team coordination | High |\n| Secure email (encrypted) | Formal notifications, documentation | High |\n| War room (physical\u002Fvirtual) | Ongoing incident coordination | Medium |\n| Incident ticketing system | Status tracking and documentation | Medium |\n| Company intranet | Broad employee communication | Standard |\n\n## Template 1: Initial Incident Notification (Internal)\n\n```\nSUBJECT: [SEVERITY] Malware Incident - Initial Notification - [DATE\u002FTIME UTC]\n\nCLASSIFICATION: CONFIDENTIAL - IR TEAM ONLY\n\nINCIDENT ID: IR-[YEAR]-[NUMBER]\nDETECTION TIME: [YYYY-MM-DD HH:MM UTC]\nNOTIFICATION TIME: [YYYY-MM-DD HH:MM UTC]\nSEVERITY: [P1\u002FP2\u002FP3\u002FP4]\n\nSUMMARY:\nA malware incident has been detected affecting [NUMBER] systems in\n[DEPARTMENT\u002FLOCATION]. The malware has been identified as [TYPE] with\n[KNOWN\u002FUNKNOWN] characteristics.\n\nCURRENT IMPACT:\n- Systems affected: [COUNT and DESCRIPTION]\n- Business functions impacted: [LIST]\n- Data at risk: [DESCRIPTION]\n- Current spread status: [CONTAINED\u002FSPREADING\u002FUNKNOWN]\n\nIMMEDIATE ACTIONS TAKEN:\n1. [ACTION - e.g., Affected endpoints isolated from network]\n2. [ACTION - e.g., EDR containment policies activated]\n3. [ACTION - e.g., Security team mobilized]\n\nNEXT STEPS:\n1. [PLANNED ACTION with TIMELINE]\n2. [PLANNED ACTION with TIMELINE]\n\nINCIDENT COMMANDER: [NAME]\nCONTACT: [PHONE\u002FENCRYPTED CHANNEL]\n\nNEXT UPDATE: [TIME] or sooner if situation changes\n\n---\nDo not forward this notification outside the IR team.\n```\n\n## Template 2: Executive Briefing\n\n```\nSUBJECT: Executive Briefing - Malware Incident IR-[YEAR]-[NUMBER]\n\nFOR: [CEO \u002F CISO \u002F CIO \u002F Board]\nFROM: [Incident Commander]\nDATE: [DATE]\nUPDATE: [#]\n\nSITUATION SUMMARY:\n[2-3 sentences describing the incident in business terms]\n\nBUSINESS IMPACT:\n- Revenue impact: [ESTIMATED\u002FNONE\u002FUNDER ASSESSMENT]\n- Operational impact: [DESCRIPTION]\n- Customer impact: [DESCRIPTION]\n- Regulatory implications: [DESCRIPTION]\n\nCURRENT STATUS: [DETECTED \u002F CONTAINED \u002F ERADICATING \u002F RECOVERING]\n\nKEY DECISIONS NEEDED:\n1. [DECISION with context and recommendation]\n2. [DECISION with context and recommendation]\n\nTIMELINE:\n- [TIME]: Incident detected\n- [TIME]: Containment initiated\n- [TIME]: [MILESTONE]\n- [TIME]: Estimated recovery (if known)\n\nEXTERNAL COMMUNICATION STATUS:\n- Regulatory notification: [REQUIRED\u002FSUBMITTED\u002FNOT REQUIRED]\n- Customer notification: [REQUIRED\u002FPLANNED\u002FNOT REQUIRED]\n- Law enforcement: [ENGAGED\u002FPLANNED\u002FNOT APPLICABLE]\n\nRESOURCE REQUIREMENTS:\n- [RESOURCE NEED - e.g., External IR firm engagement]\n- [RESOURCE NEED - e.g., Additional hardware for rebuild]\n\nNEXT UPDATE: [TIME]\n```\n\n## Template 3: Technical Advisory for IT Teams\n\n```\nSUBJECT: TECHNICAL ADVISORY - [MALWARE NAME] - Immediate Action Required\n\nSEVERITY: [CRITICAL\u002FHIGH\u002FMEDIUM]\nDATE: [DATE\u002FTIME UTC]\nADVISORY ID: TA-[YEAR]-[NUMBER]\n\nTHREAT DESCRIPTION:\n[Technical description of the malware, behavior, and indicators]\n\nAFFECTED SYSTEMS:\n- Operating Systems: [LIST]\n- Applications: [LIST]\n- Network segments: [LIST]\n\nINDICATORS OF COMPROMISE (IOCs):\nFile Hashes:\n  MD5: [HASH]\n  SHA256: [HASH]\n\nFile Names:\n  [FILENAME]\n\nNetwork Indicators:\n  C2 Domains: [DOMAIN]\n  C2 IPs: [IP ADDRESS]\n  User-Agent: [STRING]\n\nRegistry Keys:\n  [REGISTRY PATH]\n\nDETECTION METHODS:\n- EDR: [DETECTION RULE\u002FSIGNATURE]\n- SIEM: [CORRELATION RULE]\n- Network: [IDS\u002FIPS SIGNATURE]\n\nREQUIRED ACTIONS:\nPriority 1 (Immediate):\n  [ ] Block IOCs at firewall\u002Fproxy\n  [ ] Push EDR containment rules\n  [ ] Scan all endpoints for IOCs\n\nPriority 2 (Within 4 hours):\n  [ ] Apply patches [KB\u002FCVE NUMBER]\n  [ ] Update antivirus signatures\n  [ ] Review logs for historical indicators\n\nPriority 3 (Within 24 hours):\n  [ ] Conduct enterprise-wide hunt\n  [ ] Validate backup integrity\n  [ ] Update detection rules\n\nCONTACT: SOC - [PHONE] | Security Engineering - [PHONE]\n```\n\n## Template 4: Regulatory Notification\n\n```\n[ORGANIZATION LETTERHEAD]\n\n[REGULATORY BODY]\n[ADDRESS]\n\nDate: [DATE]\n\nRE: Data Security Incident Notification - [REFERENCE NUMBER]\n\nDear [TITLE\u002FNAME],\n\nPursuant to [REGULATION - e.g., GDPR Article 33, State Breach Notification Law],\n[ORGANIZATION] is providing notification of a data security incident.\n\nINCIDENT SUMMARY:\nOn [DATE], [ORGANIZATION] detected a malware incident affecting systems containing\n[TYPE OF DATA]. The incident was detected through [DETECTION METHOD].\n\nDATA POTENTIALLY AFFECTED:\n- Types of data: [PERSONAL DATA, FINANCIAL, HEALTH, etc.]\n- Number of individuals: [COUNT or ESTIMATE]\n- Categories of individuals: [CUSTOMERS, EMPLOYEES, etc.]\n\nTIMELINE:\n- [DATE]: Incident occurred (estimated)\n- [DATE]: Incident detected\n- [DATE]: Containment achieved\n- [DATE]: This notification\n\nMEASURES TAKEN:\n1. [CONTAINMENT ACTION]\n2. [INVESTIGATION ACTION]\n3. [REMEDIATION ACTION]\n\nMEASURES TO MITIGATE ADVERSE EFFECTS:\n1. [MITIGATION - e.g., Credit monitoring offered]\n2. [MITIGATION - e.g., Password resets enforced]\n\nCONTACT INFORMATION:\n[DPO\u002FPRIVACY OFFICER NAME]\n[TITLE]\n[EMAIL]\n[PHONE]\n\nRespectfully,\n[SIGNATORY]\n[TITLE]\n```\n\n## Template 5: Customer\u002FPublic Notification\n\n```\nSUBJECT: Important Security Notice from [ORGANIZATION]\n\nDear [CUSTOMER\u002FUSER],\n\nWe are writing to inform you of a security incident that may have affected\nyour information.\n\nWHAT HAPPENED:\nOn [DATE], we detected unauthorized activity on our systems involving\nmalicious software. We immediately activated our incident response procedures\nand engaged leading cybersecurity experts to investigate.\n\nWHAT INFORMATION WAS INVOLVED:\nBased on our investigation, the following types of information may have\nbeen affected: [LIST - e.g., names, email addresses, etc.]\n\nWHAT WE ARE DOING:\n- We have contained the incident and removed the malicious software\n- We have engaged [FORENSIC FIRM] to conduct a thorough investigation\n- We have enhanced our security controls to prevent similar incidents\n- We have notified relevant regulatory authorities\n\nWHAT YOU CAN DO:\n- Change your password for your [ORGANIZATION] account\n- Enable multi-factor authentication if not already active\n- Monitor your accounts for unusual activity\n- [Additional specific recommendations]\n\nADDITIONAL RESOURCES:\n- [DEDICATED SUPPORT LINE]\n- [FAQ PAGE URL]\n- [CREDIT MONITORING ENROLLMENT - if applicable]\n\nWe sincerely apologize for any concern this may cause and remain committed\nto protecting your information.\n\n[SIGNATORY]\n[TITLE]\n```\n\n## Communication Workflow\n\n### Escalation Matrix\n```\nMalware Detected\n  |\n  v\n[Classify Severity: P1\u002FP2\u002FP3\u002FP4]\n  |\n  |-- P1: Notify within 15 min\n  |     |-- Incident Commander\n  |     |-- CISO (phone call)\n  |     |-- CEO (phone call)\n  |     |-- Legal Counsel\n  |     |-- External IR firm\n  |     |-- Law enforcement (if applicable)\n  |\n  |-- P2: Notify within 1 hour\n  |     |-- CISO\n  |     |-- IT Director\n  |     |-- Legal Counsel\n  |\n  |-- P3: Notify within 4 hours\n  |     |-- Security Manager\n  |     |-- IT Director\n  |\n  |-- P4: Notify within 24 hours\n        |-- Security Team Lead\n```\n\n## References\n\n- NIST SP 800-61 Rev 2: Incident Communication Guidelines\n- GDPR Article 33: Data Breach Notification Requirements\n- SANS Incident Handler's Handbook: Communication Best Practices\n- CISA Incident Reporting Guidelines\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Building Malware Incident Communication Template\n\n## Overview\n\nEffective communication during malware incidents is critical for coordinated response, stakeholder management, and regulatory compliance. A structured communication framework ensures the right people receive appropriate information at the right time, preventing panic while maintaining transparency. Communication templates should cover internal escalation, executive briefings, technical advisories for IT teams, customer notifications, regulatory disclosures, and media statements. The framework must account for different malware types (ransomware, wiper, trojan, worm) and severity levels that drive escalation speed and audience.\n\n\n## When to Use\n\n- When deploying or configuring building malware incident communication template capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Communication Framework\n\n### Severity Classification\n\n| Severity | Description | Notification Timeline | Audience |\n|----------|-------------|----------------------|----------|\n| P1 - Critical | Ransomware, wiper, or widespread infection affecting business operations | Within 15 minutes | CISO, CEO, Legal, Board (if applicable) |\n| P2 - High | Targeted malware on critical systems, data exfiltration suspected | Within 1 hour | CISO, IT Director, Legal |\n| P3 - Medium | Contained malware infection, limited spread | Within 4 hours | Security Manager, IT Director |\n| P4 - Low | Single endpoint infection, quickly contained | Within 24 hours | Security Team Lead |\n\n### Communication Channels\n\n| Channel | Use Case | Security Level |\n|---------|----------|---------------|\n| Out-of-band phone calls | Initial critical notifications | Highest |\n| Encrypted messaging (Signal) | Real-time IR team coordination | High |\n| Secure email (encrypted) | Formal notifications, documentation | High |\n| War room (physical\u002Fvirtual) | Ongoing incident coordination | Medium |\n| Incident ticketing system | Status tracking and documentation | Medium |\n| Company intranet | Broad employee communication | Standard |\n\n## Template 1: Initial Incident Notification (Internal)\n\n```\nSUBJECT: [SEVERITY] Malware Incident - Initial Notification - [DATE\u002FTIME UTC]\n\nCLASSIFICATION: CONFIDENTIAL - IR TEAM ONLY\n\nINCIDENT ID: IR-[YEAR]-[NUMBER]\nDETECTION TIME: [YYYY-MM-DD HH:MM UTC]\nNOTIFICATION TIME: [YYYY-MM-DD HH:MM UTC]\nSEVERITY: [P1\u002FP2\u002FP3\u002FP4]\n\nSUMMARY:\nA malware incident has been detected affecting [NUMBER] systems in\n[DEPARTMENT\u002FLOCATION]. The malware has been identified as [TYPE] with\n[KNOWN\u002FUNKNOWN] characteristics.\n\nCURRENT IMPACT:\n- Systems affected: [COUNT and DESCRIPTION]\n- Business functions impacted: [LIST]\n- Data at risk: [DESCRIPTION]\n- Current spread status: [CONTAINED\u002FSPREADING\u002FUNKNOWN]\n\nIMMEDIATE ACTIONS TAKEN:\n1. [ACTION - e.g., Affected endpoints isolated from network]\n2. [ACTION - e.g., EDR containment policies activated]\n3. [ACTION - e.g., Security team mobilized]\n\nNEXT STEPS:\n1. [PLANNED ACTION with TIMELINE]\n2. [PLANNED ACTION with TIMELINE]\n\nINCIDENT COMMANDER: [NAME]\nCONTACT: [PHONE\u002FENCRYPTED CHANNEL]\n\nNEXT UPDATE: [TIME] or sooner if situation changes\n\n---\nDo not forward this notification outside the IR team.\n```\n\n## Template 2: Executive Briefing\n\n```\nSUBJECT: Executive Briefing - Malware Incident IR-[YEAR]-[NUMBER]\n\nFOR: [CEO \u002F CISO \u002F CIO \u002F Board]\nFROM: [Incident Commander]\nDATE: [DATE]\nUPDATE: [#]\n\nSITUATION SUMMARY:\n[2-3 sentences describing the incident in business terms]\n\nBUSINESS IMPACT:\n- Revenue impact: [ESTIMATED\u002FNONE\u002FUNDER ASSESSMENT]\n- Operational impact: [DESCRIPTION]\n- Customer impact: [DESCRIPTION]\n- Regulatory implications: [DESCRIPTION]\n\nCURRENT STATUS: [DETECTED \u002F CONTAINED \u002F ERADICATING \u002F RECOVERING]\n\nKEY DECISIONS NEEDED:\n1. [DECISION with context and recommendation]\n2. [DECISION with context and recommendation]\n\nTIMELINE:\n- [TIME]: Incident detected\n- [TIME]: Containment initiated\n- [TIME]: [MILESTONE]\n- [TIME]: Estimated recovery (if known)\n\nEXTERNAL COMMUNICATION STATUS:\n- Regulatory notification: [REQUIRED\u002FSUBMITTED\u002FNOT REQUIRED]\n- Customer notification: [REQUIRED\u002FPLANNED\u002FNOT REQUIRED]\n- Law enforcement: [ENGAGED\u002FPLANNED\u002FNOT APPLICABLE]\n\nRESOURCE REQUIREMENTS:\n- [RESOURCE NEED - e.g., External IR firm engagement]\n- [RESOURCE NEED - e.g., Additional hardware for rebuild]\n\nNEXT UPDATE: [TIME]\n```\n\n## Template 3: Technical Advisory for IT Teams\n\n```\nSUBJECT: TECHNICAL ADVISORY - [MALWARE NAME] - Immediate Action Required\n\nSEVERITY: [CRITICAL\u002FHIGH\u002FMEDIUM]\nDATE: [DATE\u002FTIME UTC]\nADVISORY ID: TA-[YEAR]-[NUMBER]\n\nTHREAT DESCRIPTION:\n[Technical description of the malware, behavior, and indicators]\n\nAFFECTED SYSTEMS:\n- Operating Systems: [LIST]\n- Applications: [LIST]\n- Network segments: [LIST]\n\nINDICATORS OF COMPROMISE (IOCs):\nFile Hashes:\n  MD5: [HASH]\n  SHA256: [HASH]\n\nFile Names:\n  [FILENAME]\n\nNetwork Indicators:\n  C2 Domains: [DOMAIN]\n  C2 IPs: [IP ADDRESS]\n  User-Agent: [STRING]\n\nRegistry Keys:\n  [REGISTRY PATH]\n\nDETECTION METHODS:\n- EDR: [DETECTION RULE\u002FSIGNATURE]\n- SIEM: [CORRELATION RULE]\n- Network: [IDS\u002FIPS SIGNATURE]\n\nREQUIRED ACTIONS:\nPriority 1 (Immediate):\n  [ ] Block IOCs at firewall\u002Fproxy\n  [ ] Push EDR containment rules\n  [ ] Scan all endpoints for IOCs\n\nPriority 2 (Within 4 hours):\n  [ ] Apply patches [KB\u002FCVE NUMBER]\n  [ ] Update antivirus signatures\n  [ ] Review logs for historical indicators\n\nPriority 3 (Within 24 hours):\n  [ ] Conduct enterprise-wide hunt\n  [ ] Validate backup integrity\n  [ ] Update detection rules\n\nCONTACT: SOC - [PHONE] | Security Engineering - [PHONE]\n```\n\n## Template 4: Regulatory Notification\n\n```\n[ORGANIZATION LETTERHEAD]\n\n[REGULATORY BODY]\n[ADDRESS]\n\nDate: [DATE]\n\nRE: Data Security Incident Notification - [REFERENCE NUMBER]\n\nDear [TITLE\u002FNAME],\n\nPursuant to [REGULATION - e.g., GDPR Article 33, State Breach Notification Law],\n[ORGANIZATION] is providing notification of a data security incident.\n\nINCIDENT SUMMARY:\nOn [DATE], [ORGANIZATION] detected a malware incident affecting systems containing\n[TYPE OF DATA]. The incident was detected through [DETECTION METHOD].\n\nDATA POTENTIALLY AFFECTED:\n- Types of data: [PERSONAL DATA, FINANCIAL, HEALTH, etc.]\n- Number of individuals: [COUNT or ESTIMATE]\n- Categories of individuals: [CUSTOMERS, EMPLOYEES, etc.]\n\nTIMELINE:\n- [DATE]: Incident occurred (estimated)\n- [DATE]: Incident detected\n- [DATE]: Containment achieved\n- [DATE]: This notification\n\nMEASURES TAKEN:\n1. [CONTAINMENT ACTION]\n2. [INVESTIGATION ACTION]\n3. [REMEDIATION ACTION]\n\nMEASURES TO MITIGATE ADVERSE EFFECTS:\n1. [MITIGATION - e.g., Credit monitoring offered]\n2. [MITIGATION - e.g., Password resets enforced]\n\nCONTACT INFORMATION:\n[DPO\u002FPRIVACY OFFICER NAME]\n[TITLE]\n[EMAIL]\n[PHONE]\n\nRespectfully,\n[SIGNATORY]\n[TITLE]\n```\n\n## Template 5: Customer\u002FPublic Notification\n\n```\nSUBJECT: Important Security Notice from [ORGANIZATION]\n\nDear [CUSTOMER\u002FUSER],\n\nWe are writing to inform you of a security incident that may have affected\nyour information.\n\nWHAT HAPPENED:\nOn [DATE], we detected unauthorized activity on our systems involving\nmalicious software. We immediately activated our incident response procedures\nand engaged leading cybersecurity experts to investigate.\n\nWHAT INFORMATION WAS INVOLVED:\nBased on our investigation, the following types of information may have\nbeen affected: [LIST - e.g., names, email addresses, etc.]\n\nWHAT WE ARE DOING:\n- We have contained the incident and removed the malicious software\n- We have engaged [FORENSIC FIRM] to conduct a thorough investigation\n- We have enhanced our security controls to prevent similar incidents\n- We have notified relevant regulatory authorities\n\nWHAT YOU CAN DO:\n- Change your password for your [ORGANIZATION] account\n- Enable multi-factor authentication if not already active\n- Monitor your accounts for unusual activity\n- [Additional specific recommendations]\n\nADDITIONAL RESOURCES:\n- [DEDICATED SUPPORT LINE]\n- [FAQ PAGE URL]\n- [CREDIT MONITORING ENROLLMENT - if applicable]\n\nWe sincerely apologize for any concern this may cause and remain committed\nto protecting your information.\n\n[SIGNATORY]\n[TITLE]\n```\n\n## Communication Workflow\n\n### Escalation Matrix\n```\nMalware Detected\n  |\n  v\n[Classify Severity: P1\u002FP2\u002FP3\u002FP4]\n  |\n  |-- P1: Notify within 15 min\n  |     |-- Incident Commander\n  |     |-- CISO (phone call)\n  |     |-- CEO (phone call)\n  |     |-- Legal Counsel\n  |     |-- External IR firm\n  |     |-- Law enforcement (if applicable)\n  |\n  |-- P2: Notify within 1 hour\n  |     |-- CISO\n  |     |-- IT Director\n  |     |-- Legal Counsel\n  |\n  |-- P3: Notify within 4 hours\n  |     |-- Security Manager\n  |     |-- IT Director\n  |\n  |-- P4: Notify within 24 hours\n        |-- Security Team Lead\n```\n\n## References\n\n- NIST SP 800-61 Rev 2: Incident Communication Guidelines\n- GDPR Article 33: Data Breach Notification Requirements\n- SANS Incident Handler's Handbook: Communication Best Practices\n- CISA Incident Reporting Guidelines\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":40,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: building-malware-incident-communication-template | description: Build structured communication templates for malware incidents including |   stakeholder notifications, executive briefings, technical advisories, and regulatory |   disclosures with severity-based escalation procedures. | domain: cybersecurity | subdomain: incident-response | tags: | - incident-communication | - malware-response | - stakeholder-notification | - crisis-communication | - executive-briefing | - regulatory-disclo","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-building-malware-incident-communication-template",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-10-27 02:18:29",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-malware-incident-communication-template",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-malware-incident-communication-template",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-malware-incident-communication-template","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-building-malware-incident-communication-template\u002FSKILL.md",[],[69,93,117,147,176,195],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[100,101,80,102,103,104,105,106,107,108,109,86,110,88,111,112,113,114,115,116],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":128,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[123],{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[129,130,131,132,133,134,135,136,137,88,138,139,140,141,142,143,144,104,145,146],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":161,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[153,156],{"categoryNo":154,"categoryName":155,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":157,"categoryName":158,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[162,90,163,129,80,164,165,166,104,167,168,169,170,171,172,173,174,175,86,88],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[183,184,185,186,187,188,189,190,191,88,192,111,193,194],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":213,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[201,204,207,210],{"categoryNo":202,"categoryName":203,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":205,"categoryName":206,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":208,"categoryName":209,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":211,"categoryName":212,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000036","内容创作者",[214,215,216,88,111,217,80,218,105,86,219],"writing","writing skills","new","work","editing","Existing"]