Malware Incident Response
Guides an agent through containing, analysing, removing and recovering from malware infections on endpoints.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent follows a structured six-step playbook when a malware infection is suspected: confirm the alert, check how far it has spread, contain affected machines, analyse the malware's behaviour and persistence, remove it, and validate recovery. It maps findings to MITRE ATT&CK techniques and suggests tools such as EDR, sandboxes and VirusTotal. The bundled script can hash files and look up file reputation on VirusTotal, which the agent may run to speed up triage.
Great for
- Security analysts or IT responders handling a suspected endpoint infection who want a consistent checklist
- Small security teams wanting help writing incident notes and ATT&CK mappings
- Students learning the typical stages of malware incident response
Skip it if
- Reverse engineering or deep research on malware samples; the skill itself says to use dedicated analysis procedures instead, and it is not a substitute for a trained responder during a live breach
- Live production containment without human review, since the steps (isolating hosts, disabling accounts, reimaging) can disrupt business and should be approved by staff
- Non-security users with no access to EDR or forensic tools, as most steps assume enterprise tooling
Try asking
- “I think a laptop ran an invoice attachment that may be malware. Walk me through the incident response steps.”
- “Here is a SHA-256 hash from our EDR alert. Help me check it against threat intelligence and map the behaviour to MITRE ATT&CK.”
- “We found beaconing traffic to an unknown IP from three workstations. What should containment look like?”
- “Draft an eradication and recovery checklist for ransomware on a Windows file server.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
conducting-malware-incident-response.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip conducting-malware-incident-response.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip conducting-malware-incident-response.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py before running it, and use a restricted or sandboxed VirusTotal key; only send file hashes, not confidential files, to third-party services.
- Have a human approve every containment or account-disabling action, especially on production systems.
- Provide EDR alert details (detection name, hash, process tree) up front so the agent can follow the workflow precisely.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.