# Summarize a malware analysis into IOCs and detection steps

Turns sandbox reports, threat intel, and analyst notes into a structured malware summary with indicators, ATT&CK mapping, and next actions.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Summarize, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/summarize-a-malware-analysis-into-iocs-and-detection-steps

## Prompt

```text
Summarize this malware analysis for my security team.

**Sample identifiers:** [file name, hashes, platform]
**Sources:** [PASTE sandbox report, static analysis output, threat intel notes, EDR telemetry]
**Where we saw it:** [e.g. "email attachment on 3 laptops", "found on a web server"]
**Audience:** [SOC analysts / incident response / management]

Return:
1. **One-paragraph summary** - what it is, what it does, how severe, and confidence level.
2. **Malware details** - family or type (if the sources support it), platform, delivery method, persistence, privilege escalation, command-and-control, data access or exfiltration, evasion techniques.
3. **Indicators of compromise table** - Type (hash, domain, IP, URL, file path, registry key, mutex, process name) | Value | Context | Confidence. Defang network indicators (e.g. example[.]com).
4. **MITRE ATT&CK mapping** - Tactic | Technique ID and name | Evidence from the sources.
5. **Detection ideas** - what to search for in EDR, SIEM, and network logs, and suggested detection logic in plain terms (or YARA/Sigma outlines if I ask).
6. **Response actions** - containment, eradication, and what to check on other systems.
7. **Gaps** - what the sources don't show and what further analysis would answer.

Rules: use only what's in the sources. Don't attribute the malware to a threat actor or family unless the evidence clearly supports it, and label every inference as such. This is for defense and analysis only - do not write or improve malicious code.
```

## What to fill in

- file name, hashes, platform
- e.g. "email attachment on 3 laptops", "found on a web server"
- SOC analysts / incident response / management

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.