[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F2TP24C4715D8AH9RK3J2":3,"skill-same:01M71F2TP24C4715D8AH9RK3J2":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71F2TP24C4715D8AH9RK3J2","malware-triage-yara",null,"Malware Triage Yara.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-triage-yara\u002FSKILL.md",[],[19,20,21,22,23],"triage","malware","yara","malware triage yara","cybersecurity","2026-11-10 10:12:30",false,"---\nname: malware-triage-yara\ndescription: \"Malware Triage Yara.\"\ndomain: cybersecurity\n---\n\n|\n| **YARA Rule** | Pattern matching rule defining strings, byte sequences, and conditions that identify a specific file or malware family |\n| **Condition** | Boolean expression combining string matches, file properties, and module functions to determine if a rule matches |\n| **Hex String** | Byte pattern with optional wildcards (??) and jumps ([N-M]) for matching machine code or binary data |\n| **PE Module** | YARA module providing access to PE file properties (imports, sections, timestamps, resources) for structural matching |\n| **Imphash** | MD5 hash of a PE file's import table; samples from the same family often share import hashes |\n| **Rich Header** | Undocumented PE structure containing compiler\u002Flinker metadata; consistent within malware build environments |\n| **YARA-C** | Compiled YARA rule format enabling faster scanning by pre-compiling rules for repeated use |\n\n## Tools & Systems\n\n- **YARA**: Pattern matching engine for identifying and classifying malware based on text, hex, and structural patterns\n- **yara-python**: Python bindings for YARA enabling scripted scanning, rule compilation, and integration with analysis pipelines\n- **yarGen**: Automatic YARA rule generator that creates rules from malware samples by identifying unique strings and opcodes\n- **YARA-Rules (GitHub)**: Community-maintained repository of YARA rules covering malware families, exploits, and suspicious indicators\n- **Malpedia YARA**: Curated YARA rules from the Malpedia malware encyclopedia with high-quality family-specific rules\n\n## Common Scenarios\n\n### Scenario: Creating Detection Rules for a New Malware Family\n\n**Context**: Reverse engineering of a new malware sample has identified unique strings, byte patterns, and PE characteristics. YARA rules are needed for enterprise-wide hunting and ongoing detection.\n\n**Approach**:\n1. Extract unique strings from the unpacked binary (C2 URLs, mutex names, registry paths)\n2. Identify unique byte sequences from the encryption routine or C2 protocol (from Ghidra analysis)\n3. Record PE characteristics (imphash, Rich header hash, section names, compilation timestamp range)\n4. Write a YARA rule combining string, byte pattern, and PE module conditions\n5. Test against the known malware samples to confirm true positive detection\n6. Test against a clean file corpus (Windows system files, common applications) to verify zero false positives\n7. Deploy to enterprise scanning infrastructure and threat intelligence platform\n\n**Pitfalls**:\n- Writing rules too specific to a single sample (will not detect variants with minor changes)\n- Writing rules too generic (matching legitimate software, causing false positives)\n- Using strings that appear in common libraries or frameworks (e.g., OpenSSL strings)\n- Not testing on a sufficiently large clean corpus before deployment\n\n## Output Format\n\n```\nYARA TRIAGE RESULTS\n=====================\nScan Date:        2025-09-15\nRule Sets:        apt_rules (847 rules), ransomware_rules (312 rules),\n                  trojan_rules (1,204 rules), custom_rules (45 rules)\nSamples Scanned:  2,500\nProcessing Time:  47 seconds\n\nCLASSIFICATION SUMMARY\nAPT:              12 samples (0.5%)\nRansomware:       187 samples (7.5%)\nTrojan:           423 samples (16.9%)\nUnknown:          1,878 samples (75.1%)\n\nTOP MATCHING RULES\nRule                         Matches  Family\nMalwareX_C2_Beacon           45       MalwareX\nLockBit3_Ransom_Note         38       LockBit 3.0\nEmotet_Epoch5_Loader         32       Emotet\nCobaltStrike_Beacon_Config   28       Cobalt Strike\nQakBot_DLL_Loader            25       QakBot\n\nSAMPLE DETAIL\nFile:    suspect.exe\nSHA-256: e3b0c44298fc1c149afbf4c8996fb924...\nMatches:\n  [1] MalwareX_Strings (custom)\n      - $url1 at 0x4A20: \"\u002Fgate.php?id=\"\n      - $mutex at 0x5100: \"Global\\\\CryptLocker_2025\"\n  [2] MalwareX_Decryptor (custom)\n      - $xor_loop at 0x401200: { 8A 04 0E 32 04 0F ... }\n  [3] MalwareX_PE_Characteristics (custom)\n      - PE import combination matched\nClassification: MALWAREX (HIGH CONFIDENCE)\n```\n","|\n| **YARA Rule** | Pattern matching rule defining strings, byte sequences, and conditions that identify a specific file or malware family |\n| **Condition** | Boolean expression combining string matches, file properties, and module functions to determine if a rule matches |\n| **Hex String** | Byte pattern with optional wildcards (??) and jumps ([N-M]) for matching machine code or binary data |\n| **PE Module** | YARA module providing access to PE file properties (imports, sections, timestamps, resources) for structural matching |\n| **Imphash** | MD5 hash of a PE file's import table; samples from the same family often share import hashes |\n| **Rich Header** | Undocumented PE structure containing compiler\u002Flinker metadata; consistent within malware build environments |\n| **YARA-C** | Compiled YARA rule format enabling faster scanning by pre-compiling rules for repeated use |\n\n## Tools & Systems\n\n- **YARA**: Pattern matching engine for identifying and classifying malware based on text, hex, and structural patterns\n- **yara-python**: Python bindings for YARA enabling scripted scanning, rule compilation, and integration with analysis pipelines\n- **yarGen**: Automatic YARA rule generator that creates rules from malware samples by identifying unique strings and opcodes\n- **YARA-Rules (GitHub)**: Community-maintained repository of YARA rules covering malware families, exploits, and suspicious indicators\n- **Malpedia YARA**: Curated YARA rules from the Malpedia malware encyclopedia with high-quality family-specific rules\n\n## Common Scenarios\n\n### Scenario: Creating Detection Rules for a New Malware Family\n\n**Context**: Reverse engineering of a new malware sample has identified unique strings, byte patterns, and PE characteristics. YARA rules are needed for enterprise-wide hunting and ongoing detection.\n\n**Approach**:\n1. Extract unique strings from the unpacked binary (C2 URLs, mutex names, registry paths)\n2. Identify unique byte sequences from the encryption routine or C2 protocol (from Ghidra analysis)\n3. Record PE characteristics (imphash, Rich header hash, section names, compilation timestamp range)\n4. Write a YARA rule combining string, byte pattern, and PE module conditions\n5. Test against the known malware samples to confirm true positive detection\n6. Test against a clean file corpus (Windows system files, common applications) to verify zero false positives\n7. Deploy to enterprise scanning infrastructure and threat intelligence platform\n\n**Pitfalls**:\n- Writing rules too specific to a single sample (will not detect variants with minor changes)\n- Writing rules too generic (matching legitimate software, causing false positives)\n- Using strings that appear in common libraries or frameworks (e.g., OpenSSL strings)\n- Not testing on a sufficiently large clean corpus before deployment\n\n## Output Format\n\n```\nYARA TRIAGE RESULTS\n=====================\nScan Date:        2025-09-15\nRule Sets:        apt_rules (847 rules), ransomware_rules (312 rules),\n                  trojan_rules (1,204 rules), custom_rules (45 rules)\nSamples Scanned:  2,500\nProcessing Time:  47 seconds\n\nCLASSIFICATION SUMMARY\nAPT:              12 samples (0.5%)\nRansomware:       187 samples (7.5%)\nTrojan:           423 samples (16.9%)\nUnknown:          1,878 samples (75.1%)\n\nTOP MATCHING RULES\nRule                         Matches  Family\nMalwareX_C2_Beacon           45       MalwareX\nLockBit3_Ransom_Note         38       LockBit 3.0\nEmotet_Epoch5_Loader         32       Emotet\nCobaltStrike_Beacon_Config   28       Cobalt Strike\nQakBot_DLL_Loader            25       QakBot\n\nSAMPLE DETAIL\nFile:    suspect.exe\nSHA-256: e3b0c44298fc1c149afbf4c8996fb924...\nMatches:\n  [1] MalwareX_Strings (custom)\n      - $url1 at 0x4A20: \"\u002Fgate.php?id=\"\n      - $mutex at 0x5100: \"Global\\\\CryptLocker_2025\"\n  [2] MalwareX_Decryptor (custom)\n      - $xor_loop at 0x401200: { 8A 04 0E 32 04 0F ... }\n  [3] MalwareX_PE_Characteristics (custom)\n      - PE import combination matched\nClassification: MALWAREX (HIGH CONFIDENCE)\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-triage-yara","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-triage-yara",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-triage-yara",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-triage-yara","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-triage-yara\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",476,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-triage-yara\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]