How to Use the Malware Analysis Skill with YARA Rules: A Six-Stage Workflow

The malware-analysis skill orchestrates a complete six-stage investigation pipeline that validates YARA rules against static binaries and dynamically enriches results through the CAPE sandbox, storing all matches as structured IOC data.

The reverse-skill repository by zhaoxuya520 implements a comprehensive malware analysis framework that integrates YARA rule scanning into a reproducible, auditable workflow. This guide explains how to use the malware analysis skill with YARA rules to move from rule conception to detection, leveraging both static analysis and dynamic sandbox execution against malicious samples.

Understanding the Six-Stage YARA Workflow Architecture

According to skills/malware-analysis/SKILL.md, the malware-analysis skill implements a six-stage investigation pipeline specifically designed for YARA-driven detection. When YARA rules are required, the skill enforces a strict architecture that validates rules before execution and correlates results with the MITRE ATT&CK framework.

Phase 1: Preparation Following YARA + Sigma Methodology

The workflow begins with rule authoring guided by skills/malware-analysis/references/yara-sigma-rules.md. This document defines the YARA + Sigma methodology, ensuring rules are compatible with both static scanners and the CAPE sandbox. Rules must include proper metadata and string definitions to support later IOC extraction.

Example rule structure following the methodology:

rule SuspiciousPE
{
    meta:
        description = "Detects packed PE files"
        author      = "analyst@example.com"
    strings:
        $a = {E8 ?? ?? ?? ?? 83 C4 04 5B}
    condition:
        $a
}

Phase 2: Rule Validation Using Python Bindings

Before any scanning occurs, the "YARA 规则验证" (YARA Rule Validation) section in skills/malware-analysis/SKILL.md mandates validation using the Python YARA bindings. Install the required dependency:

pip install yara-python

Validate and compile rules programmatically to catch syntax errors:

import yara

# Load and compile the rule (replace path with your rule file)

rules = yara.compile(filepath="suspicious_pe.yar")

# Scan a binary file

matches = rules.match(filepath="sample.exe")
if matches:
    print("YARA match found:", matches)
else:
    print("No match")

Phase 3: Static Scanning Against Binaries

Once validated, the skill applies rules to target binaries using either the Python API or the command-line yara tool. All matches are immediately stored as Indicator-of-Compromise (IOC) data for inclusion in the final analysis report. This static phase extracts initial evidence before any dynamic execution.

Phase 4: Dynamic Enrichment via CAPE Sandbox

For samples requiring behavioral analysis, the skill invokes the CAPE sandbox, which features native YARA support. As documented in skills/malware-analysis/references/sandbox-orchestration.md, the "YARA 规则扫描" (YARA Rule Scanning) functionality automatically loads the same rule set validated in Phase 2:

# Launch CAPE with the YARA rule set

cape -r suspicious_pe.yar -i sample.exe

CAPE applies the rules during runtime execution and reports any hits in its JSON output, enabling detection of unpacked or decrypted strings that may not be visible in static analysis.

Phase 5: Result Correlation with MITRE ATT&CK

The final phases merge static and dynamic matches using the "YARA → MITRE 映射" (YARA to MITRE Mapping) guidelines in SKILL.md. Detected indicators are mapped to specific MITRE ATT&CK techniques, providing tactical context for the final report. The "Phase 4: YARA 规则编写" section details how to structure rules to facilitate this automatic correlation.

Key Reference Files in the Repository

Understanding the repository structure is essential for implementing this workflow:

• skills/malware-analysis/SKILL.md — Contains the core skill definition, the six-stage workflow breakdown, and the "YARA 规则验证" validation requirements.
• skills/malware-analysis/references/yara-sigma-rules.md — Provides the detailed methodology for authoring YARA and Sigma rules according to the skill's standards.
• skills/malware-analysis/references/sandbox-orchestration.md — Documents CAPE integration, specifically how the "YARA 规则扫描" feature injects rules into dynamic analysis.
• skills/malware-analysis/references/anti-analysis-techniques.md — Offers context on common evasion techniques, essential for writing YARA rules that detect anti-analysis behaviors.

Summary

• The malware-analysis skill implements a strict six-stage pipeline for YARA-based investigation in reverse-skill.
• Rules must follow the YARA + Sigma methodology documented in yara-sigma-rules.md to ensure compatibility.
• Validation is mandatory using yara-python before any scanning occurs, as specified in the "YARA 规则验证" section.
• Static analysis uses the Python API or CLI tool, while dynamic analysis leverages CAPE's native YARA integration.
• All detections are correlated with MITRE ATT&CK techniques via the "YARA → MITRE 映射" process and stored as structured IOC data.

Frequently Asked Questions

What Python library is required for YARA rule validation in this skill?

The skill requires the yara-python package, installable via pip install yara-python, to compile and validate rules before deployment. This requirement is explicitly defined in the "YARA 规则验证" section of skills/malware-analysis/SKILL.md.

How does the malware-analysis skill correlate YARA matches with threat intelligence?

The skill implements a "YARA → MITRE 映射" (YARA to MITRE Mapping) phase that automatically maps detection strings and rule conditions to specific MITRE ATT&CK techniques, enriching the final report with tactical context and TTP classifications.

Can the same YARA rules be used for both static and dynamic analysis?

Yes. The workflow validates rules once using Python bindings for static scanning, then reuses the identical rule set during CAPE sandbox execution. The skills/malware-analysis/references/sandbox-orchestration.md file documents how CAPE automatically loads these rules for runtime detection.

Where should analysts store custom YARA rules when using this skill?

While the skill accepts any file path via the filepath parameter in Python or the -r flag in CAPE, the methodology in skills/malware-analysis/references/yara-sigma-rules.md provides organizational guidelines for rule storage within the malware-analysis skill context, ensuring compatibility with both static scanners and the CAPE integration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}