Data Points

🦠 Malware Family

🔧 Native workbench

🔗 Analyst pivots

🔍 Lookup

📜 Playbook — Malware Family exploitation

1. Direction — frame the requirement for Malware Family: what decision does this support, by when?
2. Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Malware Family

A malware family is a named cluster of related malicious code sharing lineage, capabilities, and TTPs (e.g. Emotet, Qakbot, Cobalt Strike, LockBit). It matters because family attribution unlocks known indicators, config-extraction, C2 patterns, and links a sample to actors and campaigns.

Format: Normalized family name/alias set (MISP galaxy, Malpedia slug win.emotet); associated MITRE ATT&CK Software ID (S0367); YARA rule name; config schema per family.

📡 How it is collected

• Sample classification via YARA/signatures
• Sandbox behavioral clustering
• Threat-intel vendor naming and reports
• Config extractor output (C2, campaign IDs)
• Code-similarity attribution engines
• AV detection-name normalization

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• YARA family signature authoring
• Config/C2 extraction per family
• Code-genome similarity attribution
• ATT&CK TTP mapping & heatmapping
• C2 pattern & beacon profiling
• Campaign clustering by config artifacts
• Cross-family loader/dropper linkage
• Alias reconciliation across vendors

🔧 Tools

• YARA
• MalConfScan / CAPE extractors
• Intezer
• Ghidra / IDA
• MISP
• CAPA
• Volatility

⚡ Workbench actions

• Resolve aliases & Malpedia entry
• List associated hashes
• Extract C2 config
• Map to ATT&CK
• Generate/pull YARA
• Pivot to actor & campaign
• Timeline sample sightings
• Cluster related families

📊 Dashboard KPIs

📂 Open