Disciplines

🦠 Malware Intelligence (MALINT)

🔌 Sources for Malware Intelligence (8)

🎯 Mission Domains served

🎫 Data Points

🔍 Lookup

📊 Pre-built Queries · Malware Intelligence

🔄 Live Datasets & APIs (7 key-free · ingestible)

📜 Playbook — Malware Intelligence collection

1. Direction — frame the requirement for Malware Intelligence: what decision does this support, by when?
2. Collection — collect from the 8 mapped sources (7 free) — filter the catalog by MALINT; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

🔗 Pivot to related disciplines

✨ Enrichment pathways

🎯 Mission

Malware Intelligence triages and reverse-engineers malicious samples to extract indicators, capabilities, configuration, and command-and-control infrastructure, and to attribute samples to families and actors. It answers what malware family a sample belongs to, what infrastructure and capabilities it carries, and how it relates to prior campaigns.

📡 Collection methods

• Sample triage and automated sandbox detonation to capture behavior and dropped artifacts
• Static analysis (strings, imports, PE structure) and dynamic analysis for runtime IOCs
• YARA-based retrohunting across malware repositories for related samples
• Configuration and C2 extraction from packed or encoded samples
• Code-similarity and imphash/fuzzy-hash clustering to group variants into families
• C2 infrastructure tracking and beacon fingerprinting (JARM/JA3S) for live nodes

📚 Key sources & datasets

🎫 Data points produced

🔧 Tools & frameworks

• YARA
• Ghidra
• CAPE Sandbox
• capa
• CyberChef
• Detect It Easy
• FLOSS
• pefile/imphash

📜 Malware Intelligence Tradecraft

1. Acquire samples from feeds and repositories and record hashes, file type, and first-seen provenance
2. Detonate in a sandbox and run static/dynamic analysis to extract strings, IOCs, and dropped files
3. Analyze capabilities against ATT&CK, decode configuration, and pull C2 endpoints and campaign identifiers
4. Attribute the sample to a family and actor via imphash/code-similarity clustering, YARA family rules, and infrastructure reuse
5. Disseminate an analysis report with extracted IOCs, a YARA rule, and detection guidance to defenders and CTI
6. Push C2 indicators to blocking and hunting, and retrohunt for additional samples using the new YARA signature

📊 Dashboard KPIs

🔍 Pre-built queries

🔗 Cross-discipline pivots

🗃 Data Management

🧩 Advanced Capabilities