Summarize a malware analysis into IOCs and detection steps
Turns sandbox reports, threat intel, and analyst notes into a structured malware summary with indicators, ATT&CK mapping, and next actions.
The prompt
Summarize this malware analysis for my security team.
Sample identifiers: [file name, hashes, platform]
Sources: [PASTE sandbox report, static analysis output, threat intel notes, EDR telemetry]
Where we saw it: [e.g. "email attachment on 3 laptops", "found on a web server"]
Audience: [SOC analysts / incident response / management]
Return:
1. One-paragraph summary - what it is, what it does, how severe, and confidence level.
2. Malware details - family or type (if the sources support it), platform, delivery method, persistence, privilege escalation, command-and-control, data access or exfiltration, evasion techniques.
3. Indicators of compromise table - Type (hash, domain, IP, URL, file path, registry key, mutex, process name) | Value | Context | Confidence. Defang network indicators (e.g. example[.]com).
4. MITRE ATT&CK mapping - Tactic | Technique ID and name | Evidence from the sources.
5. Detection ideas - what to search for in EDR, SIEM, and network logs, and suggested detection logic in plain terms (or YARA/Sigma outlines if I ask).
6. Response actions - containment, eradication, and what to check on other systems.
7. Gaps - what the sources don't show and what further analysis would answer.
Rules: use only what's in the sources. Don't attribute the malware to a threat actor or family unless the evidence clearly supports it, and label every inference as such. This is for defense and analysis only - do not write or improve malicious code.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- file name, hashes, platform
- e.g. "email attachment on 3 laptops", "found on a web server"
- SOC analysts / incident response / management
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Summarize a cyber threat report into insights and actionsDistills a threat intelligence report into its key findings, attacker techniques, indicators, and the actions your security team should take.
- Break a feature into small, shippable pull requestsSplits a large feature into a sequence of small, independently mergeable PRs with a safe order and clear scope for each.
- Analyze logs to find what went wrongReads logs to identify errors, patterns, and the likely root cause.
- Get a beginner-friendly code review of my first projectA ranked set of the five improvements that matter most, explained simply, plus what you did well and what to learn next.