尧图网站建设 
基于 Malpedia 的恶意软件家族关系分析别名溯源、威胁组织归因与 YARA 检测规则构建实战【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills导读本文以仓库中的analyzing-malware-family-relationships-with-malpedia技能为主线系统讲解如何通过 Malpedia 公共 API 查询恶意软件家族别名aliases、提取社区与厂商 YARA 规则、关联威胁组织threat actor并绘制家族间加载器-载荷loader-payload链条与共享作者关系。读完本文你将掌握 Malpedia 数据模型与命名规范、一套可直接运行的 Python 分析流程对应 scripts/agent.py以及如何把家族关系情报转化为可落地的检测规则与威胁情报报告。一、技能概览与适用场景Malpedia 是由 Fraunhofer FKIE 维护的协作式恶意软件知识库系统收录了超过 2,600 个恶意软件家族的别名、YARA 规则、威胁组织关联与参考报告是理解恶意软件谱系、追踪变体演进、把样本关联到具体威胁团体的权威资源。本技能即围绕 Malpedia API 展开覆盖以下四类典型任务家族情报查询通过 API 检索家族名称、别名、描述、威胁组织归属与参考链接关系图谱构建把别名-家族家族-威胁组织家族-家族关系绘制成可分析的关系图检测规则提取拉取 Malpedia 上社区与厂商贡献的 YARA 规则并批量编译成规则集威胁生态分析识别共享工具shared tooling、加载器-载荷投放链支撑威胁狩猎与检测覆盖验证。该技能在仓库中属于threat-intelligence子领域见技能 frontmatter 的domain: cybersecurity、subdomain: threat-intelligence核心标签包括malpedia、malware-family、yara、threat-actor、variant-analysis。其典型使用时机包括安全事件调查中需要厘清样本属于哪个家族及其变体谱系时为某家族构建检测规则或威胁狩猎查询时SOC 分析师需要结构化分析流程时以及验证针对相关攻击技术如 MITRE ATTCK 中的 T1587.001、T1027、T1071的监控覆盖时。二、前置条件与环境准备在运行本技能涉及的任何脚本或代码片段前需准备以下环境与凭据前置条件说明Python 3.9建议使用虚拟环境避免污染系统 Pythonrequests库所有 API 调用的 HTTP 客户端scripts/agent.py直接依赖yara-python库可选用于在本地编译/校验提取到的 YARA 规则stix2库可选用于将关系情报导出为 STIX 2.x 标准对象Malpedia API key需在 Malpedia 官网注册获取认证头为Authorization: apitoken YOUR_API_KEY恶意软件样本可选用于对 YARA 规则进行真实验证本仓库为只读资料库上述依赖与 API key 需要由使用者自行获取配置技能本体SKILL.md本身即可作为独立参考无需额外安装。三、核心概念3.1 Malpedia 数据模型Malpedia 以Family家族为组织单元例如win.cobalt_strike。每个家族聚合了以下信息aliases别名不同厂商对同一家族的不同命名如 Cobalt Strike 又被称作 Beacon、CobaltStrikeYARA rules检测规则社区与厂商分别贡献的规则集合actor associations威胁组织关联使用该家族的攻击团体reference reports参考报告记录该家族的 CTI 报告sample hashes样本哈希各变体对应的代表性样本。该数据模型与 api-reference.md 中/get/family/{family_name}的返回字段一一对应common_name主名称、alt_names别名列表、description描述、attribution归因威胁组织列表、urls参考链接。3.2 恶意软件家族命名规范Malpedia 采用platform.family_name的命名格式例如win.emotet、elf.mirai、apk.flubot。常见平台前缀包括前缀平台win.Windowself.Linuxapk.Androidosx.macOSpy.Python这一标准化命名直接解决了威胁情报领域的一物多名many names难题——不同厂商对同一恶意软件往往给出不同名称而 Malpedia 以统一家族标识作为锚点聚合各方别名。3.3 家族关系类型家族之间主要存在四类关系parent-child父子关系代码复用或分叉如某家族 fork 出变体loader-payload加载器-载荷关系典型如 Emotet 加载 TrickBotTrickBot 再投放 Ryukshared authorship共享作者同一威胁组织开发了多个工具infrastructure sharing基础设施共享多个家族共用同一 C2 框架。api-reference.md 将关系归纳为三类机器可读的关系类型also_known_as家族别名、shared_actor被同一威胁组织使用、variant_of派生变体。这与scripts/agent.py中build_family_graph()的建模完全一致别名关系生成also_known_as边共享威胁组织生成shared_actor边。四、工作流 Step 1查询 Malpedia API 获取家族信息4.1 API 认证与基础端点所有请求均基于基础 URLhttps://malpedia.caad.fkie.fraunhofer.de/api并通过请求头完成认证Authorization: apitoken YOUR_API_KEYapi-reference.md 汇总了本技能使用的核心端点端点作用GET /list/families返回{family_name: {alt_names, description, attribution, urls}}字典GET /get/family/{family_name}返回单个家族详情GET /get/yara/{family_name}返回按规则来源分组的 YARA 规则字典GET /list/actors返回{actor_name: {alt_names, description, families}}字典GET /get/actor/{actor_name}返回单个威胁组织详情含families关联家族GET /get/sample/{sha256}与/get/sample/{sha256}/zip获取样本信息或样本压缩包4.2 封装客户端类SKILL.md 给出了一个完整的MalpediaClient类封装了上述端点的调用逻辑import requests import json from collections import defaultdict class MalpediaClient: BASE_URL https://malpedia.caad.fkie.fraunhofer.de/api def __init__(self, api_key): self.headers {Authorization: fapitoken {api_key}} def get_family_list(self): Get list of all malware families. resp requests.get(f{self.BASE_URL}/list/families, headersself.headers, timeout30) if resp.status_code 200: families resp.json() print(f[] Malpedia: {len(families)} malware families) return families return {} def get_family_info(self, family_name): Get detailed information about a malware family. resp requests.get(f{self.BASE_URL}/get/family/{family_name}, headersself.headers, timeout30) if resp.status_code 200: info resp.json() print(f[] Family: {family_name}) print(f Aliases: {info.get(alt_names, [])}) print(f Actors: {[a.get(value, ) for a in info.get(attribution, [])]}) print(f URLs: {len(info.get(urls, []))} references) return info print(f[-] Family not found: {family_name}) return None def get_family_yara(self, family_name): Get YARA rules for a malware family. resp requests.get(f{self.BASE_URL}/get/yara/{family_name}, headersself.headers, timeout30) if resp.status_code 200: rules resp.json() rule_count sum(len(v) for v in rules.values()) if isinstance(rules, dict) else 0 print(f[] YARA rules for {family_name}: {rule_count} rules) return rules return {} def get_actor_families(self, actor_name): Get malware families associated with a threat actor. resp requests.get(f{self.BASE_URL}/get/actor/{actor_name}, headersself.headers, timeout30) if resp.status_code 200: data resp.json() families data.get(families, {}) print(f[] {actor_name}: {len(families)} malware families) return data return {} def search_families(self, keyword): Search families by keyword. all_families self.get_family_list() matches { name: info for name, info in all_families.items() if keyword.lower() in name.lower() or keyword.lower() in str(info.get(alt_names, [])).lower() } print(f[] Search {keyword}: {len(matches)} matches) return matches client MalpediaClient(YOUR_MALPEDIA_API_KEY) families client.get_family_list() emotet_info client.get_family_info(win.emotet)要点说明超时与容错每个请求设置timeout30并在非 200 响应时返回空结构而非抛异常保证在家族名不存在如拼写错误时程序可继续运行别名检索search_families()同时在家族名与alt_names中做不区分大小写的子串匹配是应对一物多名的实用检索手段示例调用先拉全量家族列表再查询win.emotet详情输出其别名、归属组织与参考链接数量。4.3 与仓库脚本的对应实现仓库提供的 scripts/agent.py 以函数式实现等价逻辑malpedia_get()统一封装认证头与异常抛出resp.raise_for_status()list_families()、get_family_info()、get_family_yara()、list_actors()、get_actor_info()逐一对应上述端点。与 SKILL.md 中偏重探查演示的客户端类相比agent.py 更偏批量产出——它额外实现了关系图构建、单家族深度分析与 JSON 报告落盘见第六节。五、工作流 Step 2映射恶意软件家族关系5.1 威胁组织武器库生态测绘MalwareFamilyMapper.map_actor_ecosystem()以威胁组织为起点枚举其使用的全部家族并为每个家族补充别名、描述、共享组织与参考数量最终打印该组织的武器库生态class MalwareFamilyMapper: def __init__(self, malpedia_client): self.client malpedia_client self.relationship_graph defaultdict(list) def map_actor_ecosystem(self, actor_name): Map the malware ecosystem used by a threat actor. actor_data self.client.get_actor_families(actor_name) families actor_data.get(families, {}) ecosystem { actor: actor_name, families: [], family_count: len(families), } for family_name in families: info self.client.get_family_info(family_name) if info: ecosystem[families].append({ name: family_name, aliases: info.get(alt_names, []), description: info.get(description, )[:200], shared_actors: [ a.get(value, ) for a in info.get(attribution, []) ], reference_count: len(info.get(urls, [])), }) print(f\n {actor_name} Malware Ecosystem ) for fam in ecosystem[families]: shared [a for a in fam[shared_actors] if a ! actor_name] print(f {fam[name]}) print(f Aliases: {fam[aliases][:5]}) if shared: print(f Also used by: {shared}) return ecosystem def find_shared_tooling(self, actor_names): Find malware families shared between threat actors. actor_families {} for actor in actor_names: data self.client.get_actor_families(actor) actor_families[actor] set(data.get(families, {}).keys()) # Find overlaps shared {} for i, actor1 in enumerate(actor_names): for actor2 in actor_names[i1:]: common actor_families[actor1] actor_families[actor2] if common: shared[f{actor1} - {actor2}] sorted(common) print(f\n Shared Tooling Analysis ) for pair, families in shared.items(): print(f {pair}: {len(families)} shared families) for f in families[:5]: print(f - {f}) return sharedfind_shared_tooling()是共享工具分析的关键算法把每个组织的家族集合转化为 Pythonset两两求交集即可定位多个组织共同使用的家族——这在归因分析中是判断组织间协作、并购或工具复用的强信号。5.2 加载器-载荷投放链建模build_loader_payload_chain()内置了一批公开报道中反复出现的投放链知识用于把某个家族放到谁加载它、它又投放谁的上下文里def build_loader_payload_chain(self, family_name): Build the loader-payload delivery chain for a family. info self.client.get_family_info(family_name) if not info: return {} chain { family: family_name, description: info.get(description, ), known_loaders: [], known_payloads: [], } # Common known delivery chains known_chains { win.emotet: {loaders: [email/macro], payloads: [win.trickbot, win.qakbot, win.cobalt_strike]}, win.trickbot: {loaders: [win.emotet], payloads: [win.ryuk, win.conti, win.cobalt_strike]}, win.qakbot: {loaders: [email/macro, win.emotet], payloads: [win.cobalt_strike, win.blackbasta]}, win.cobalt_strike: {loaders: [win.emotet, win.trickbot, win.qakbot], payloads: [ransomware]}, } if family_name in known_chains: chain[known_loaders] known_chains[family_name][loaders] chain[known_payloads] known_chains[family_name][payloads] return chain示例调用mapper MalwareFamilyMapper(client) ecosystem mapper.map_actor_ecosystem(Wizard Spider) shared mapper.find_shared_tooling([Wizard Spider, FIN7, Lazarus Group]) chain mapper.build_loader_payload_chain(win.emotet)从上述内置链条可以直观看出经典勒索软件攻击链的形态win.emotet以钓鱼宏为加载器投放win.trickbot/win.qakbot进而投放win.ryuk、win.conti等勒索软件或直接落到win.cobalt_strike做后渗透控制。这类链条在事件响应中可直接作为上游入口-中游驻留-下游破坏的检测与排查指引。六、工作流 Step 3提取并编译 YARA 检测规则Malpedia 的价值之一在于聚合了社区与厂商双重来源的 YARA 规则。以下函数批量拉取多个家族的规则并合并为单个规则文件供检测工程直接使用def compile_yara_ruleset(client, family_names, output_filemalware_yara_rules.yar): Compile YARA rules for multiple malware families. all_rules [] for family in family_names: yara_data client.get_family_yara(family) if isinstance(yara_data, dict): for source, rules in yara_data.items(): if isinstance(rules, list): for rule in rules: all_rules.append(f// Source: {source} - Family: {family}\n{rule}) elif isinstance(rules, str): all_rules.append(f// Source: {source} - Family: {family}\n{rules}) with open(output_file, w) as f: f.write(f// Malpedia YARA Rules - {len(all_rules)} rules\n) f.write(f// Families: {, .join(family_names)}\n\n) for rule in all_rules: f.write(rule \n\n) print(f[] Compiled {len(all_rules)} YARA rules to {output_file}) return all_rules compile_yara_ruleset(client, [win.emotet, win.trickbot, win.cobalt_strike])关键设计来源可追溯每条规则前追加// Source: {source} - Family: {family}注释保留规则出处与家族归属避免规则来源不明导致误报排查困难类型兼容同时处理list与str两种规则值形态不同家族的返回结构存在差异文件头信息输出文件首部写入规则总数与家族清单便于版本管理与审计。生成的.yar规则文件可进一步配合yara-python编译并在样本集上验证命中率从而评估规则质量与误报率。七、仓库配套工具agent.py 与情报报告生成除 SKILL.md 内嵌的示例代码外仓库还提供了完整的命令行工具 scripts/agent.py。它把上述能力整合为可重复执行的流水线核心亮点包括命令行参数--api-key必填、--family指定家族、--list-families列出前 100 个家族、--build-graph构建全量关系图、--output报告输出路径默认malpedia_report.json关系图构建build_family_graph()遍历全量家族数据生成also_known_as与shared_actor两类关系边并产出{actor: [families]}映射表。其边生成逻辑如下for family_name, info in families_data.items(): if not isinstance(info, dict): continue alt_names info.get(alt_names, []) actors info.get(attribution, []) for actor in actors: family_actors[actor].append(family_name) for alt in alt_names: relationships.append({ source: family_name, target: alt, relation: also_known_as, }) for actor, actor_families in family_actors.items(): if len(actor_families) 1: for i in range(len(actor_families)): for j in range(i 1, len(actor_families)): relationships.append({ source: actor_families[i], target: actor_families[j], relation: shared_actor, actor: actor, })深度分析analyze_family()对指定家族聚合描述、别名、归因、参考链接与 YARA 规则数量并针对 YARA 拉取失败做异常兜底yara_rule_count 0报告生成generate_report()输出带时间戳的 JSON 报告含家族数、关系数、组织数、关系明细截取前 200 条与组织-家族映射截取前 50 条并打印一行摘要日志。典型运行方式python3 skills/analyzing-malware-family-relationships-with-malpedia/scripts/agent.py \ --api-key YOUR_MALPEDIA_API_KEY \ --build-graph \ --output malpedia_report.json八、验证标准技能执行完毕后可通过以下清单确认分析质量对应 SKILL.md 的 Validation CriteriaMalpedia API 成功返回恶意软件家族列表已检索到家族详情且包含别名、威胁组织与参考链接组织-家族关系映射正确无缺失或错配已识别多个组织之间的共享工具shared toolingYARA 规则已成功提取并编译为规则文件加载器-载荷投放链已记录并可用于威胁情报输出。九、框架映射MITRE ATTCK 与 NIST CSF本技能在仓库的框架映射体系中定位清晰MITRE ATTCK技能 frontmattermitre_attack字段关联T1587.001Develop Capabilities: Malware开发能力恶意软件、T1027Obfuscated Files or Information、T1071Application Layer Protocol。其中T1587.001也在 api-reference.md 末尾被单独标注对应攻击者自研恶意软件能力的开发阶段与家族谱系研究支撑防御方预判其自研武器的用法一致NIST CSF 2.0技能 frontmatternist_csf字段关联ID.RA-01识别风险、ID.RA-05威胁情报、DE.CM-01持续监控、DE.AE-02异常事件分析。从 mappings/nist-csf/csf-alignment.md 的子领域映射表可以看到threat-intelligence43 个技能的主 CSF 职能为 Identify/Detect归因于ID.RA与DE.AE与本技能情报驱动检测的定位相互印证。十、参考资料技能文档主文档Malpedia API 参考Malpedia 家族关系分析脚本 agent.pyNIST CSF 2.0 子领域对齐表MITRE ATTCK Navigator 覆盖层以上仓库内文档覆盖了 Malpedia 的认证方式、全部关键端点、返回字段定义与关系类型Malpedia 平台的注册与完整 API 使用细则请以其官网及官方 API 文档为准本文不再展开外部链接。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考 基于 Malpedia 的恶意软件家族关系分析：别名溯源、威胁组织归因与 YARA 检测规则构建实战
基于 Malpedia 的恶意软件家族关系分析别名溯源、威胁组织归因与 YARA 检测规则构建实战【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills导读本文以仓库中的analyzing-malware-family-relationships-with-malpedia技能为主线系统讲解如何通过 Malpedia 公共 API 查询恶意软件家族别名aliases、提取社区与厂商 YARA 规则、关联威胁组织threat actor并绘制家族间加载器-载荷loader-payload链条与共享作者关系。读完本文你将掌握 Malpedia 数据模型与命名规范、一套可直接运行的 Python 分析流程对应 scripts/agent.py以及如何把家族关系情报转化为可落地的检测规则与威胁情报报告。一、技能概览与适用场景Malpedia 是由 Fraunhofer FKIE 维护的协作式恶意软件知识库系统收录了超过 2,600 个恶意软件家族的别名、YARA 规则、威胁组织关联与参考报告是理解恶意软件谱系、追踪变体演进、把样本关联到具体威胁团体的权威资源。本技能即围绕 Malpedia API 展开覆盖以下四类典型任务家族情报查询通过 API 检索家族名称、别名、描述、威胁组织归属与参考链接关系图谱构建把别名-家族家族-威胁组织家族-家族关系绘制成可分析的关系图检测规则提取拉取 Malpedia 上社区与厂商贡献的 YARA 规则并批量编译成规则集威胁生态分析识别共享工具shared tooling、加载器-载荷投放链支撑威胁狩猎与检测覆盖验证。该技能在仓库中属于threat-intelligence子领域见技能 frontmatter 的domain: cybersecurity、subdomain: threat-intelligence核心标签包括malpedia、malware-family、yara、threat-actor、variant-analysis。其典型使用时机包括安全事件调查中需要厘清样本属于哪个家族及其变体谱系时为某家族构建检测规则或威胁狩猎查询时SOC 分析师需要结构化分析流程时以及验证针对相关攻击技术如 MITRE ATTCK 中的 T1587.001、T1027、T1071的监控覆盖时。二、前置条件与环境准备在运行本技能涉及的任何脚本或代码片段前需准备以下环境与凭据前置条件说明Python 3.9建议使用虚拟环境避免污染系统 Pythonrequests库所有 API 调用的 HTTP 客户端scripts/agent.py直接依赖yara-python库可选用于在本地编译/校验提取到的 YARA 规则stix2库可选用于将关系情报导出为 STIX 2.x 标准对象Malpedia API key需在 Malpedia 官网注册获取认证头为Authorization: apitoken YOUR_API_KEY恶意软件样本可选用于对 YARA 规则进行真实验证本仓库为只读资料库上述依赖与 API key 需要由使用者自行获取配置技能本体SKILL.md本身即可作为独立参考无需额外安装。三、核心概念3.1 Malpedia 数据模型Malpedia 以Family家族为组织单元例如win.cobalt_strike。每个家族聚合了以下信息aliases别名不同厂商对同一家族的不同命名如 Cobalt Strike 又被称作 Beacon、CobaltStrikeYARA rules检测规则社区与厂商分别贡献的规则集合actor associations威胁组织关联使用该家族的攻击团体reference reports参考报告记录该家族的 CTI 报告sample hashes样本哈希各变体对应的代表性样本。该数据模型与 api-reference.md 中/get/family/{family_name}的返回字段一一对应common_name主名称、alt_names别名列表、description描述、attribution归因威胁组织列表、urls参考链接。3.2 恶意软件家族命名规范Malpedia 采用platform.family_name的命名格式例如win.emotet、elf.mirai、apk.flubot。常见平台前缀包括前缀平台win.Windowself.Linuxapk.Androidosx.macOSpy.Python这一标准化命名直接解决了威胁情报领域的一物多名many names难题——不同厂商对同一恶意软件往往给出不同名称而 Malpedia 以统一家族标识作为锚点聚合各方别名。3.3 家族关系类型家族之间主要存在四类关系parent-child父子关系代码复用或分叉如某家族 fork 出变体loader-payload加载器-载荷关系典型如 Emotet 加载 TrickBotTrickBot 再投放 Ryukshared authorship共享作者同一威胁组织开发了多个工具infrastructure sharing基础设施共享多个家族共用同一 C2 框架。api-reference.md 将关系归纳为三类机器可读的关系类型also_known_as家族别名、shared_actor被同一威胁组织使用、variant_of派生变体。这与scripts/agent.py中build_family_graph()的建模完全一致别名关系生成also_known_as边共享威胁组织生成shared_actor边。四、工作流 Step 1查询 Malpedia API 获取家族信息4.1 API 认证与基础端点所有请求均基于基础 URLhttps://malpedia.caad.fkie.fraunhofer.de/api并通过请求头完成认证Authorization: apitoken YOUR_API_KEYapi-reference.md 汇总了本技能使用的核心端点端点作用GET /list/families返回{family_name: {alt_names, description, attribution, urls}}字典GET /get/family/{family_name}返回单个家族详情GET /get/yara/{family_name}返回按规则来源分组的 YARA 规则字典GET /list/actors返回{actor_name: {alt_names, description, families}}字典GET /get/actor/{actor_name}返回单个威胁组织详情含families关联家族GET /get/sample/{sha256}与/get/sample/{sha256}/zip获取样本信息或样本压缩包4.2 封装客户端类SKILL.md 给出了一个完整的MalpediaClient类封装了上述端点的调用逻辑import requests import json from collections import defaultdict class MalpediaClient: BASE_URL https://malpedia.caad.fkie.fraunhofer.de/api def __init__(self, api_key): self.headers {Authorization: fapitoken {api_key}} def get_family_list(self): Get list of all malware families. resp requests.get(f{self.BASE_URL}/list/families, headersself.headers, timeout30) if resp.status_code 200: families resp.json() print(f[] Malpedia: {len(families)} malware families) return families return {} def get_family_info(self, family_name): Get detailed information about a malware family. resp requests.get(f{self.BASE_URL}/get/family/{family_name}, headersself.headers, timeout30) if resp.status_code 200: info resp.json() print(f[] Family: {family_name}) print(f Aliases: {info.get(alt_names, [])}) print(f Actors: {[a.get(value, ) for a in info.get(attribution, [])]}) print(f URLs: {len(info.get(urls, []))} references) return info print(f[-] Family not found: {family_name}) return None def get_family_yara(self, family_name): Get YARA rules for a malware family. resp requests.get(f{self.BASE_URL}/get/yara/{family_name}, headersself.headers, timeout30) if resp.status_code 200: rules resp.json() rule_count sum(len(v) for v in rules.values()) if isinstance(rules, dict) else 0 print(f[] YARA rules for {family_name}: {rule_count} rules) return rules return {} def get_actor_families(self, actor_name): Get malware families associated with a threat actor. resp requests.get(f{self.BASE_URL}/get/actor/{actor_name}, headersself.headers, timeout30) if resp.status_code 200: data resp.json() families data.get(families, {}) print(f[] {actor_name}: {len(families)} malware families) return data return {} def search_families(self, keyword): Search families by keyword. all_families self.get_family_list() matches { name: info for name, info in all_families.items() if keyword.lower() in name.lower() or keyword.lower() in str(info.get(alt_names, [])).lower() } print(f[] Search {keyword}: {len(matches)} matches) return matches client MalpediaClient(YOUR_MALPEDIA_API_KEY) families client.get_family_list() emotet_info client.get_family_info(win.emotet)要点说明超时与容错每个请求设置timeout30并在非 200 响应时返回空结构而非抛异常保证在家族名不存在如拼写错误时程序可继续运行别名检索search_families()同时在家族名与alt_names中做不区分大小写的子串匹配是应对一物多名的实用检索手段示例调用先拉全量家族列表再查询win.emotet详情输出其别名、归属组织与参考链接数量。4.3 与仓库脚本的对应实现仓库提供的 scripts/agent.py 以函数式实现等价逻辑malpedia_get()统一封装认证头与异常抛出resp.raise_for_status()list_families()、get_family_info()、get_family_yara()、list_actors()、get_actor_info()逐一对应上述端点。与 SKILL.md 中偏重探查演示的客户端类相比agent.py 更偏批量产出——它额外实现了关系图构建、单家族深度分析与 JSON 报告落盘见第六节。五、工作流 Step 2映射恶意软件家族关系5.1 威胁组织武器库生态测绘MalwareFamilyMapper.map_actor_ecosystem()以威胁组织为起点枚举其使用的全部家族并为每个家族补充别名、描述、共享组织与参考数量最终打印该组织的武器库生态class MalwareFamilyMapper: def __init__(self, malpedia_client): self.client malpedia_client self.relationship_graph defaultdict(list) def map_actor_ecosystem(self, actor_name): Map the malware ecosystem used by a threat actor. actor_data self.client.get_actor_families(actor_name) families actor_data.get(families, {}) ecosystem { actor: actor_name, families: [], family_count: len(families), } for family_name in families: info self.client.get_family_info(family_name) if info: ecosystem[families].append({ name: family_name, aliases: info.get(alt_names, []), description: info.get(description, )[:200], shared_actors: [ a.get(value, ) for a in info.get(attribution, []) ], reference_count: len(info.get(urls, [])), }) print(f\n {actor_name} Malware Ecosystem ) for fam in ecosystem[families]: shared [a for a in fam[shared_actors] if a ! actor_name] print(f {fam[name]}) print(f Aliases: {fam[aliases][:5]}) if shared: print(f Also used by: {shared}) return ecosystem def find_shared_tooling(self, actor_names): Find malware families shared between threat actors. actor_families {} for actor in actor_names: data self.client.get_actor_families(actor) actor_families[actor] set(data.get(families, {}).keys()) # Find overlaps shared {} for i, actor1 in enumerate(actor_names): for actor2 in actor_names[i1:]: common actor_families[actor1] actor_families[actor2] if common: shared[f{actor1} - {actor2}] sorted(common) print(f\n Shared Tooling Analysis ) for pair, families in shared.items(): print(f {pair}: {len(families)} shared families) for f in families[:5]: print(f - {f}) return sharedfind_shared_tooling()是共享工具分析的关键算法把每个组织的家族集合转化为 Pythonset两两求交集即可定位多个组织共同使用的家族——这在归因分析中是判断组织间协作、并购或工具复用的强信号。5.2 加载器-载荷投放链建模build_loader_payload_chain()内置了一批公开报道中反复出现的投放链知识用于把某个家族放到谁加载它、它又投放谁的上下文里def build_loader_payload_chain(self, family_name): Build the loader-payload delivery chain for a family. info self.client.get_family_info(family_name) if not info: return {} chain { family: family_name, description: info.get(description, ), known_loaders: [], known_payloads: [], } # Common known delivery chains known_chains { win.emotet: {loaders: [email/macro], payloads: [win.trickbot, win.qakbot, win.cobalt_strike]}, win.trickbot: {loaders: [win.emotet], payloads: [win.ryuk, win.conti, win.cobalt_strike]}, win.qakbot: {loaders: [email/macro, win.emotet], payloads: [win.cobalt_strike, win.blackbasta]}, win.cobalt_strike: {loaders: [win.emotet, win.trickbot, win.qakbot], payloads: [ransomware]}, } if family_name in known_chains: chain[known_loaders] known_chains[family_name][loaders] chain[known_payloads] known_chains[family_name][payloads] return chain示例调用mapper MalwareFamilyMapper(client) ecosystem mapper.map_actor_ecosystem(Wizard Spider) shared mapper.find_shared_tooling([Wizard Spider, FIN7, Lazarus Group]) chain mapper.build_loader_payload_chain(win.emotet)从上述内置链条可以直观看出经典勒索软件攻击链的形态win.emotet以钓鱼宏为加载器投放win.trickbot/win.qakbot进而投放win.ryuk、win.conti等勒索软件或直接落到win.cobalt_strike做后渗透控制。这类链条在事件响应中可直接作为上游入口-中游驻留-下游破坏的检测与排查指引。六、工作流 Step 3提取并编译 YARA 检测规则Malpedia 的价值之一在于聚合了社区与厂商双重来源的 YARA 规则。以下函数批量拉取多个家族的规则并合并为单个规则文件供检测工程直接使用def compile_yara_ruleset(client, family_names, output_filemalware_yara_rules.yar): Compile YARA rules for multiple malware families. all_rules [] for family in family_names: yara_data client.get_family_yara(family) if isinstance(yara_data, dict): for source, rules in yara_data.items(): if isinstance(rules, list): for rule in rules: all_rules.append(f// Source: {source} - Family: {family}\n{rule}) elif isinstance(rules, str): all_rules.append(f// Source: {source} - Family: {family}\n{rules}) with open(output_file, w) as f: f.write(f// Malpedia YARA Rules - {len(all_rules)} rules\n) f.write(f// Families: {, .join(family_names)}\n\n) for rule in all_rules: f.write(rule \n\n) print(f[] Compiled {len(all_rules)} YARA rules to {output_file}) return all_rules compile_yara_ruleset(client, [win.emotet, win.trickbot, win.cobalt_strike])关键设计来源可追溯每条规则前追加// Source: {source} - Family: {family}注释保留规则出处与家族归属避免规则来源不明导致误报排查困难类型兼容同时处理list与str两种规则值形态不同家族的返回结构存在差异文件头信息输出文件首部写入规则总数与家族清单便于版本管理与审计。生成的.yar规则文件可进一步配合yara-python编译并在样本集上验证命中率从而评估规则质量与误报率。七、仓库配套工具agent.py 与情报报告生成除 SKILL.md 内嵌的示例代码外仓库还提供了完整的命令行工具 scripts/agent.py。它把上述能力整合为可重复执行的流水线核心亮点包括命令行参数--api-key必填、--family指定家族、--list-families列出前 100 个家族、--build-graph构建全量关系图、--output报告输出路径默认malpedia_report.json关系图构建build_family_graph()遍历全量家族数据生成also_known_as与shared_actor两类关系边并产出{actor: [families]}映射表。其边生成逻辑如下for family_name, info in families_data.items(): if not isinstance(info, dict): continue alt_names info.get(alt_names, []) actors info.get(attribution, []) for actor in actors: family_actors[actor].append(family_name) for alt in alt_names: relationships.append({ source: family_name, target: alt, relation: also_known_as, }) for actor, actor_families in family_actors.items(): if len(actor_families) 1: for i in range(len(actor_families)): for j in range(i 1, len(actor_families)): relationships.append({ source: actor_families[i], target: actor_families[j], relation: shared_actor, actor: actor, })深度分析analyze_family()对指定家族聚合描述、别名、归因、参考链接与 YARA 规则数量并针对 YARA 拉取失败做异常兜底yara_rule_count 0报告生成generate_report()输出带时间戳的 JSON 报告含家族数、关系数、组织数、关系明细截取前 200 条与组织-家族映射截取前 50 条并打印一行摘要日志。典型运行方式python3 skills/analyzing-malware-family-relationships-with-malpedia/scripts/agent.py \ --api-key YOUR_MALPEDIA_API_KEY \ --build-graph \ --output malpedia_report.json八、验证标准技能执行完毕后可通过以下清单确认分析质量对应 SKILL.md 的 Validation CriteriaMalpedia API 成功返回恶意软件家族列表已检索到家族详情且包含别名、威胁组织与参考链接组织-家族关系映射正确无缺失或错配已识别多个组织之间的共享工具shared toolingYARA 规则已成功提取并编译为规则文件加载器-载荷投放链已记录并可用于威胁情报输出。九、框架映射MITRE ATTCK 与 NIST CSF本技能在仓库的框架映射体系中定位清晰MITRE ATTCK技能 frontmattermitre_attack字段关联T1587.001Develop Capabilities: Malware开发能力恶意软件、T1027Obfuscated Files or Information、T1071Application Layer Protocol。其中T1587.001也在 api-reference.md 末尾被单独标注对应攻击者自研恶意软件能力的开发阶段与家族谱系研究支撑防御方预判其自研武器的用法一致NIST CSF 2.0技能 frontmatternist_csf字段关联ID.RA-01识别风险、ID.RA-05威胁情报、DE.CM-01持续监控、DE.AE-02异常事件分析。从 mappings/nist-csf/csf-alignment.md 的子领域映射表可以看到threat-intelligence43 个技能的主 CSF 职能为 Identify/Detect归因于ID.RA与DE.AE与本技能情报驱动检测的定位相互印证。十、参考资料技能文档主文档Malpedia API 参考Malpedia 家族关系分析脚本 agent.pyNIST CSF 2.0 子领域对齐表MITRE ATTCK Navigator 覆盖层以上仓库内文档覆盖了 Malpedia 的认证方式、全部关键端点、返回字段定义与关系类型Malpedia 平台的注册与完整 API 使用细则请以其官网及官方 API 文档为准本文不再展开外部链接。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考