malware-analysis-claude-skills MCP — حالات الاستخدام, التثبيت & عرض مباشر

لماذا تستخدمه

الميزات الأساسية

5 specialized sub-skills covering the complete malware analysis workflow
Single orchestrator entry point with automatic routing
Offline-compatible with REMnux and FlareVM isolated analysis environments
Generates production-ready YARA, Sigma, and Suricata detection rules
Enterprise-grade technical report generation

عرض مباشر

كيف يبدو في الممارسة

malware-analysis-claude-skills.replay ▶ جاهز

0/0

التثبيت

اختر العميل

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "malware-analysis-claude-skills": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/gl0bal01/malware-analysis-claude-skills"
      ]
    }
  }
}

افتح Claude Desktop → Settings → Developer → Edit Config. أعد التشغيل بعد الحفظ.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "malware-analysis-claude-skills": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/gl0bal01/malware-analysis-claude-skills"
      ]
    }
  }
}

يستخدم Cursor نفس مخطط mcpServers مثل Claude Desktop. إعدادات المشروع أولى من الإعدادات العامة.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "malware-analysis-claude-skills": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/gl0bal01/malware-analysis-claude-skills"
      ]
    }
  }
}

انقر على أيقونة MCP Servers في شريط Cline الجانبي، ثم "Edit Configuration".

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "malware-analysis-claude-skills": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/gl0bal01/malware-analysis-claude-skills"
      ]
    }
  }
}

نفس الصيغة مثل Claude Desktop. أعد تشغيل Windsurf لتطبيق التغييرات.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "malware-analysis-claude-skills",
      "command": "TODO",
      "args": [
        "See README: https://github.com/gl0bal01/malware-analysis-claude-skills"
      ]
    }
  ]
}

يستخدم Continue مصفوفة من كائنات الخادم بدلاً من خريطة.

~/.config/zed/settings.json

{
  "context_servers": {
    "malware-analysis-claude-skills": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/gl0bal01/malware-analysis-claude-skills"
        ]
      }
    }
  }
}

أضف إلى context_servers. يعيد Zed التحميل تلقائيًا عند الحفظ.

claude mcp add malware-analysis-claude-skills -- TODO 'See README: https://github.com/gl0bal01/malware-analysis-claude-skills'

أمر من سطر واحد. تحقق باستخدام claude mcp list. احذف باستخدام claude mcp remove.

حالات الاستخدام

استخدامات عملية: malware-analysis-claude-skills

How to triage a suspicious file in a sandboxed environment

👤 SOC analysts and malware analysts triaging incoming samples ⏱ ~30 min intermediate

متى تستخدمه: You received a suspicious file and need a quick assessment before deep analysis.

المتطلبات الأساسية

Claude with malware analysis skills installed — Upload SKILL.md orchestrator and sub-skill folders to Claude
Isolated analysis environment — Use REMnux or FlareVM in a VM with no network access

الخطوات

Initial triage

I have a suspicious PE file at /samples/malware.exe. Perform initial triage: file type, hashes, imports, strings analysis, and threat classification.✓ تم النسخ

→ File metadata, hash values, suspicious imports/strings, threat assessment
Dynamic analysis

Set up a dynamic analysis environment and execute the sample. Monitor for file system changes, network connections, registry modifications, and process creation.✓ تم النسخ

→ Behavioral report with IOCs

النتيجة: A threat classification with IOCs and behavioral summary.

المزالق

Running malware outside a sandbox — ALWAYS use an isolated VM with no network access. Never analyze malware on your host machine.

اجمعها مع: filesystem

Generate detection rules from malware analysis findings

👤 Detection engineers building SOC rules ⏱ ~45 min advanced

متى تستخدمه: You've analyzed malware and need to create detection rules for your SIEM/IDS.

المتطلبات الأساسية

Completed malware analysis — Run triage and dynamic analysis first

الخطوات

Generate detection rules

Based on our analysis findings, generate YARA rules for file detection, Sigma rules for log-based detection, and Suricata rules for network signatures.✓ تم النسخ

→ Three rule files with clear documentation
Write the report

Generate a complete malware analysis report including executive summary, technical details, IOCs, and recommended mitigations.✓ تم النسخ

→ Professional report ready for stakeholders

النتيجة: Production-ready detection rules and a professional analysis report.

المزالق

Rules too specific to one sample — Ask Claude to generalize rules to catch variants, not just the exact sample

اجمعها مع: filesystem

التركيبات

اجمعها مع خوادم MCP أخرى لتحقيق نتائج x10

malware-analysis-claude-skills + filesystem

Save analysis artifacts, detection rules, and reports to organized folders

Save the YARA rules to ~/detections/yara/ and the final report to ~/reports/malware-analysis.md.✓ تم النسخ

الأدوات

ما يوفره هذا الـ MCP

الأداة	المدخلات	متى تستدعيها
Malware Triage	file path	Quick assessment of a suspicious file
Dynamic Analysis	file path, sandbox config	Monitor runtime behavior in a sandbox
Specialized File Analyzer	file path	Analyze non-PE files (.NET, Office, PDF, scripts)
Detection Engineer	analysis findings	Generate detection rules from findings
Report Writer	analysis data	Generate professional malware analysis reports

التكلفة والحدود

تكلفة التشغيل

حصة API: N/A — skills are local. Optional MCP connections to VirusTotal/Threat.Zone for enrichment.
الرموز لكل استدعاء: 1000–5000 tokens per skill invocation
التكلفة المالية: Free (MIT license). Threat intelligence enrichment may require API keys.
نصيحة: Start with triage to decide if deep analysis is needed. Don't run all 5 skills on every sample.

الأمان

الصلاحيات والأسرار ونطاق الأثر

تخزين بيانات الاعتماد: Optional VirusTotal/Threat.Zone API keys in env vars for enrichment

نقل البيانات الخارجي: Designed for offline use. Optional threat intelligence lookups are opt-in.

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
ALWAYS analyze malware in isolated environments (REMnux, FlareVM) with no network access.
Never execute malware samples on your host machine or connected networks.
Detection rules should be tested in a staging environment before deploying to production.

استكشاف الأخطاء

الأخطاء الشائعة وحلولها

Skill not routing correctly

Ensure the root SKILL.md orchestrator is loaded. It handles routing to sub-skills automatically.

تحقق: Check that all 5 sub-skill folders are present alongside the orchestrator

Analysis tools not found in sandbox

Use REMnux or FlareVM which come pre-installed with standard analysis tools.

تحقق: which strings && which file && which yara

Report missing IOCs

Run both triage and dynamic analysis before generating the report to ensure complete data.

تحقق: Review triage and dynamic analysis outputs

البدائل

malware-analysis-claude-skills مقابل البدائل

البديل	متى تستخدمها	المقايضة
hexstrike-ai	You need active security tools alongside analysis rather than skills-based workflows	Broader tool coverage but less structured analysis workflow

malware-analysis-claude-skills

لماذا تستخدمه

الميزات الأساسية

عرض مباشر

كيف يبدو في الممارسة

التثبيت

اختر العميل

حالات الاستخدام

استخدامات عملية: malware-analysis-claude-skills

How to triage a suspicious file in a sandboxed environment

المتطلبات الأساسية

الخطوات

المزالق

Generate detection rules from malware analysis findings

المتطلبات الأساسية

الخطوات

المزالق

التركيبات

اجمعها مع خوادم MCP أخرى لتحقيق نتائج x10

الأدوات

ما يوفره هذا الـ MCP

التكلفة والحدود

تكلفة التشغيل

الأمان

الصلاحيات والأسرار ونطاق الأثر

استكشاف الأخطاء

الأخطاء الشائعة وحلولها

البدائل

malware-analysis-claude-skills مقابل البدائل

المزيد

الموارد