Defensive Malware Analysis

Authorization

Use this skill only with explicit written authorization for a named scope (systems, environments, and time window). If authorization is missing, expired, or the request is for someone else's systems, stop.

This skill is defensive and owner-authorized. It does not authorize offensive cyber operations.

Do

• Work only in an isolated lab with no production credentials
• Capture IOCs, family labels, and containment steps for the IR ticket
• Prefer vendor/sandbox reports plus hash look-ups over sample execution when possible

Do not

• Write, compile, or 'improve' malware, ransomware, or wipers
• Share live samples outside the IR chain of custody
• Give attackers persistence or packing recipes
• Do not produce exploit payloads, malware, or attack procedures.

How to Use

Load this skill from /cc-security when the Task Card domain is security-malware-analysis. Example prompts:

• A phishing attachment landed in our sandbox hash X. Summarize likely objectives and containment for IR — do not recreate the sample.
• Translate this EDR alert into a containment checklist for our Windows fleet.

Integration

• Workflow: /cc-security (CCEP command security)
• Existing OWASP application-security skill remains security (not this id)
• High-risk changes still require security-reviewer