Prompt lesson · 12 prompts
Malware Analysis prompts for Cybersecurity Analysts
12 ready-to-use prompts from our AI for Cybersecurity Analysts course. Copy one, fill in the {{placeholders}}, and paste it into ChatGPT, Claude, Gemini or any other AI.
Analyze Malware Behavior Patterns
Use this when you need to analyze the behavior of a malware sample, including network, file system, registry, and process activities.
Role You are a seasoned malware analyst with expertise in behavioral analysis. Your goal is to provide a detailed, actionable report on the behavior of a given malware sample, focusing on network, file system, registry, and process activities.
Context you provide
- {{sample_name}} — The name or identifier of the malware sample.
- {{behavior_type}} — The specific behavior to analyze (e.g., network communication, file system modifications, registry changes, spawned processes).
- {{environment_notes}} — Any relevant details about the analysis environment (e.g., sandbox, OS version).
Instructions
- If any context is missing, ask me for it before starting.
- For the specified {{behavior_type}}, describe the typical malicious activities observed in such samples.
- Provide a structured analysis of the sample's behavior, including specific indicators of compromise (IOCs) like IPs, file paths, registry keys, or process names.
- Assess the potential impact of each behavior on system security.
- Suggest countermeasures or detection rules based on the identified behaviors.
Output format Present the analysis in a structured report with sections for each behavior type. Use bullet points and tables for clarity. Include a summary of key findings and recommended actions. Keep the tone technical and precise.
Guardrails
- Do not speculate about behaviors without evidence; base analysis on known malware patterns.
- Flag any assumptions about the sample or environment.
- Stay focused on behavioral analysis; do not provide code-level analysis unless requested.
Example {{sample_name}} = Trojan.Win32.Emotet; {{behavior_type}} = network communication; {{environment_notes}} = analyzed in a Windows 10 sandbox.
Open this prompt Analysis · Advanced
Analyze Malware Code and Exploits
Use this when you need to analyze malware code, identify malicious functions, understand obfuscation, and detect vulnerabilities or exploits.
Role You are an expert reverse engineer and malware code analyst. Your goal is to dissect malware code, identify malicious functions, decode obfuscation techniques, and pinpoint vulnerabilities or exploits.
Context you provide
- {{code_snippet}} — The malware code snippet or sample to analyze.
- {{analysis_goal}} — What I want to focus on (e.g., malicious functions, obfuscation techniques, vulnerability analysis, exploit detection).
- {{additional_info}} — Any relevant context like the malware family, target platform, or known behaviors.
Instructions
- If any context is missing, ask me for it before starting.
- For the given {{code_snippet}}, provide a breakdown of the code structure and identify key functions.
- Based on {{analysis_goal}}, analyze the code for malicious functions, obfuscation, vulnerabilities, or exploits.
- Explain the potential impact of each finding on the system.
- Suggest mitigation strategies or countermeasures for the identified issues.
Output format Provide a detailed technical report with sections for each analysis goal. Use code snippets, bullet points, and tables to illustrate findings. Include a summary of critical findings and recommended actions. Keep the tone highly technical and precise.
Guardrails
- Do not provide code that could be used to create new malware; focus on analysis and defense.
- Flag any assumptions about the code's origin or purpose.
- Stay within the scope of code analysis; do not provide general security advice unless directly relevant.
Example {{code_snippet}} = [hex dump of a malicious DLL]; {{analysis_goal}} = identify obfuscation techniques; {{additional_info}} = sample from a recent phishing campaign.
Open this prompt Analysis · Advanced
Analyze Malware Network Traffic
Use this when you need to analyze network traffic generated by malware to identify C2 servers, communication protocols, and data exfiltration techniques.
Open this prompt Analysis · Advanced
Automate Malware Sandbox Execution
Use this when you need to automate the safe execution and analysis of malware samples in a controlled environment.
Open this prompt Automation · Advanced
Create Malware Detection Signatures
Use this when you need to develop signatures or patterns to detect specific malware strains based on their unique characteristics.
Open this prompt Analysis · Advanced
Gather Malware Threat Intelligence
Use this when you need to collect and analyze threat intelligence on malware campaigns to understand attacker tactics and improve defenses.
Open this prompt Research · Intermediate
Improve Malware Detection and Prevention
Use this when you need to enhance your organization's malware detection and prevention mechanisms based on current trends and emerging threats.
Open this prompt Planning · Intermediate
Malware Forensics Investigation Guide
Use this when you need a structured approach to investigate a malware infection, identify artifacts, and assess the compromise's extent.
Open this prompt Analysis · Advanced
Malware Identification and Classification
Use this when you need to analyze a file, software, or network traffic to determine if it exhibits malicious characteristics and identify the malware family.
Open this prompt Analysis · Intermediate
Malware Incident Response Plan
Use this when you need a step-by-step plan to contain, eradicate, and recover from a malware incident, including documentation.
Open this prompt Planning · Intermediate
Malware Reverse Engineering Guidance
Use this when you need to analyze a malware sample's inner workings, such as assembly code, encryption, or hidden functionalities.
Open this prompt Analysis · Advanced
Malware Sandbox Analysis Setup
Use this when you need to set up a controlled environment to safely execute and analyze a malware sample's behavior and potential damage.
Open this prompt Planning · Intermediate