From d4e38c2867bc52f4206d822e53790b504a52d563 Mon Sep 17 00:00:00 2001 From: Kevin Glynn Date: Thu, 16 Jul 2026 17:08:46 -0400 Subject: [PATCH 1/2] fix: reduce Windows Defender false positive on fileless malware skill Add AV false-positive guidance for issue #100, move inline YARA rule to references/yara-fileless-powershell.yar, and replace literal encoded PowerShell payload with a placeholder in the sample report. --- .../SKILL.md | 25 ++++++++----------- .../references/api-reference.md | 2 ++ .../references/yara-fileless-powershell.yar | 13 ++++++++++ 3 files changed, 26 insertions(+), 14 deletions(-) create mode 100644 skills/detecting-fileless-malware-techniques/references/yara-fileless-powershell.yar diff --git a/skills/detecting-fileless-malware-techniques/SKILL.md b/skills/detecting-fileless-malware-techniques/SKILL.md index df48fa41..aec1a6c5 100644 --- a/skills/detecting-fileless-malware-techniques/SKILL.md +++ b/skills/detecting-fileless-malware-techniques/SKILL.md @@ -49,6 +49,12 @@ mitre_attack: **Do not use** for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware. +## Windows Defender / Antivirus False Positive + +Some endpoint antivirus products — notably **Windows Defender** (signature `Trojan:script/Wacatac.H!ml`) — may quarantine this skill's `SKILL.md` as malicious. This is a **known false positive**: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code. + +**If quarantined:** restore the file from quarantine, add an exclusion for your local agent skills directory, and see [GitHub issue #100](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/issues/100) for discussion. YARA strings live in `references/yara-fileless-powershell.yar` (not inline in this file) to reduce scanner triggers while preserving the rule for analysts. + ## Prerequisites - Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes) @@ -239,22 +245,13 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE" # PowerShell CLR usage (indicates .NET reflection loading) vol3 -f memory.dmp windows.cmdline | grep -i "powershell" -# Scan for known fileless frameworks -vol3 -f memory.dmp yarascan.YaraScan --yara-rules " -rule Fileless_PowerShell { - strings: - \$s1 = \"System.Reflection.Assembly\" ascii wide - \$s2 = \"[System.Convert]::FromBase64String\" ascii wide - \$s3 = \"Invoke-Expression\" ascii wide - \$s4 = \"DownloadString\" ascii wide - condition: - 2 of them -} -" +# Scan for known fileless frameworks (rule file avoids AV false positives on SKILL.md) +vol3 -f memory.dmp yarascan.YaraScan --yara-file references/yara-fileless-powershell.yar # Extract PowerShell command history from memory vol3 -f memory.dmp windows.cmdline -strings memory.dmp | grep -i "invoke-\|iex \|downloadstring\|-encodedcommand" +# Search memory strings for common fileless indicators (encoded commands, cradles, reflection) +strings memory.dmp | grep -iE 'encodedcommand|downloadstring|invoke-expression|\.reflection\.' ``` ### Step 5: Build Comprehensive Detection Rules @@ -400,7 +397,7 @@ Filter Name: WindowsUpdateCheck Filter Query: SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' Consumer: CommandLineEventConsumer -Command: powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA... +Command: powershell.exe -nop -w hidden -enc DECODED PAYLOAD [Layer 1] Base64 UTF-16LE decode diff --git a/skills/detecting-fileless-malware-techniques/references/api-reference.md b/skills/detecting-fileless-malware-techniques/references/api-reference.md index 02a216a2..35f4a543 100644 --- a/skills/detecting-fileless-malware-techniques/references/api-reference.md +++ b/skills/detecting-fileless-malware-techniques/references/api-reference.md @@ -61,6 +61,8 @@ vol3 -f memory.dmp windows.malfind --dump --pid 1234 ## Suspicious PowerShell Indicators +Detection patterns to search for in Script Block Logging (Event ID 4104) and memory strings. See `yara-fileless-powershell.yar` in this directory for a Volatility YARA rule covering the same indicators. + ``` -enc / -EncodedCommand → Base64-encoded command IEX / Invoke-Expression → Dynamic code execution diff --git a/skills/detecting-fileless-malware-techniques/references/yara-fileless-powershell.yar b/skills/detecting-fileless-malware-techniques/references/yara-fileless-powershell.yar new file mode 100644 index 00000000..24508812 --- /dev/null +++ b/skills/detecting-fileless-malware-techniques/references/yara-fileless-powershell.yar @@ -0,0 +1,13 @@ +// YARA rule for Volatility yarascan — fileless PowerShell indicators in memory. +// Stored separately from SKILL.md to reduce antivirus false positives on the skill file. +// See GitHub issue #100. + +rule Fileless_PowerShell { + strings: + $s1 = "System.Reflection.Assembly" ascii wide + $s2 = "[System.Convert]::FromBase64String" ascii wide + $s3 = "Invoke-Expression" ascii wide + $s4 = "DownloadString" ascii wide + condition: + 2 of them +} From eec1246feec2f61d5135bb38ac6f3b26d31a58f8 Mon Sep 17 00:00:00 2001 From: Kevin Glynn Date: Thu, 16 Jul 2026 17:16:09 -0400 Subject: [PATCH 2/2] fix: use explicit path for YARA rule in Volatility command The --yara-file reference should not assume a specific working directory. Use a placeholder path that analysts will substitute for their setup. --- skills/detecting-fileless-malware-techniques/SKILL.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/skills/detecting-fileless-malware-techniques/SKILL.md b/skills/detecting-fileless-malware-techniques/SKILL.md index aec1a6c5..da372f0a 100644 --- a/skills/detecting-fileless-malware-techniques/SKILL.md +++ b/skills/detecting-fileless-malware-techniques/SKILL.md @@ -245,8 +245,9 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE" # PowerShell CLR usage (indicates .NET reflection loading) vol3 -f memory.dmp windows.cmdline | grep -i "powershell" -# Scan for known fileless frameworks (rule file avoids AV false positives on SKILL.md) -vol3 -f memory.dmp yarascan.YaraScan --yara-file references/yara-fileless-powershell.yar +# Scan for known fileless frameworks +# YARA rule lives in references/yara-fileless-powershell.yar (kept separate to reduce AV false positives) +vol3 -f memory.dmp yarascan.YaraScan --yara-file /path/to/yara-fileless-powershell.yar # Extract PowerShell command history from memory vol3 -f memory.dmp windows.cmdline