Merge pull request #112 from kevglynn/contrib/100-defender-false-positive

fix: reduce Windows Defender false positive on fileless malware skill

skills/detecting-fileless-malware-techniques/SKILL.md

@@ -53,6 +53,12 @@ mitre_attack:
 
 **Do not use** for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.
 
+## Windows Defender / Antivirus False Positive
+
+Some endpoint antivirus products — notably **Windows Defender** (signature `Trojan:script/Wacatac.H!ml`) — may quarantine this skill's `SKILL.md` as malicious. This is a **known false positive**: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code.
+
+**If quarantined:** restore the file from quarantine, add an exclusion for your local agent skills directory, and see [GitHub issue #100](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/issues/100) for discussion. YARA strings live in `references/yara-fileless-powershell.yar` (not inline in this file) to reduce scanner triggers while preserving the rule for analysts.
+
 ## Prerequisites
 
 - Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)
@@ -244,21 +250,13 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE"
 vol3 -f memory.dmp windows.cmdline | grep -i "powershell"
 
 # Scan for known fileless frameworks
-vol3 -f memory.dmp yarascan.YaraScan --yara-rules "
-rule Fileless_PowerShell {
-    strings:
-        \$s1 = \"System.Reflection.Assembly\" ascii wide
-        \$s2 = \"[System.Convert]::FromBase64String\" ascii wide
-        \$s3 = \"Invoke-Expression\" ascii wide
-        \$s4 = \"DownloadString\" ascii wide
-    condition:
-        2 of them
-}
-"
+# YARA rule lives in references/yara-fileless-powershell.yar (kept separate to reduce AV false positives)
+vol3 -f memory.dmp yarascan.YaraScan --yara-file /path/to/yara-fileless-powershell.yar
 
 # Extract PowerShell command history from memory
 vol3 -f memory.dmp windows.cmdline
-strings memory.dmp | grep -i "invoke-\|iex \|downloadstring\|-encodedcommand"
+# Search memory strings for common fileless indicators (encoded commands, cradles, reflection)
+strings memory.dmp | grep -iE 'encodedcommand|downloadstring|invoke-expression|\.reflection\.'
 ```
 
 ### Step 5: Build Comprehensive Detection Rules
@@ -404,7 +402,7 @@ Filter Name:      WindowsUpdateCheck
 Filter Query:     SELECT * FROM __InstanceModificationEvent WITHIN 300
                   WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
 Consumer:         CommandLineEventConsumer
-Command:          powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...
+Command:          powershell.exe -nop -w hidden -enc <BASE64_UTF16LE_PAYLOAD>
 
 DECODED PAYLOAD
 [Layer 1] Base64 UTF-16LE decode

skills/detecting-fileless-malware-techniques/references/api-reference.md

@@ -61,6 +61,8 @@ vol3 -f memory.dmp windows.malfind --dump --pid 1234
 
 ## Suspicious PowerShell Indicators
 
+Detection patterns to search for in Script Block Logging (Event ID 4104) and memory strings. See `yara-fileless-powershell.yar` in this directory for a Volatility YARA rule covering the same indicators.
+
 ```
 -enc / -EncodedCommand    → Base64-encoded command
 IEX / Invoke-Expression   → Dynamic code execution

skills/detecting-fileless-malware-techniques/references/yara-fileless-powershell.yar

@@ -0,0 +1,13 @@
+// YARA rule for Volatility yarascan — fileless PowerShell indicators in memory.
+// Stored separately from SKILL.md to reduce antivirus false positives on the skill file.
+// See GitHub issue #100.
+
+rule Fileless_PowerShell {
+    strings:
+        $s1 = "System.Reflection.Assembly" ascii wide
+        $s2 = "[System.Convert]::FromBase64String" ascii wide
+        $s3 = "Invoke-Expression" ascii wide
+        $s4 = "DownloadString" ascii wide
+    condition:
+        2 of them
+}