agentsclimarketplace

Monitoring process and file behavior

Skill meltedinhex/analyst-ai-pack/skills/monitoring-process-and-file-behavior

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill monitoring-process-and-file-behavior

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Summarizes runtime behavior of a sample from Procmon-style operation logs — process and thread creation, file and registry writes, and network-related operations — to build a behavioral profile. Activates for requests to analyze Procmon output, summarize sample behavior, or profile process/file/registry activity from a sandbox run.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.9 KB, as published. Nobody here has run it

Monitoring Process and File Behavior

When to Use

  • You have a Procmon CSV/XML export (or equivalent sandbox operation log) from detonating a sample.
  • You need a concise behavioral profile: child processes, file writes, registry persistence, and network-related calls.
  • You are correlating dynamic behavior with static indicators.

Do not use this to detonate the sample yourself — it consumes already-captured logs. Run the sample only inside an isolated, instrumented sandbox you own.

Prerequisites

  • A Procmon CSV export (or comparable operation log) from an isolated detonation.

Safety & Handling

  • Only consume logs; never execute the sample on an analyst workstation.
  • Defang any captured URLs/hosts before sharing.

Workflow

Step 1: Summarize operations by category

python scripts/analyst.py summarize procmon.csv

Counts operations by class (Process/Thread, File, Registry, Network) and lists the busiest paths.

Step 2: Identify process tree

Extract Process Create events to reconstruct parent/child relationships and command lines — LOLBins (powershell, rundll32, mshta) spawned from the sample are high-signal.

Step 3: Identify persistence and drops

Registry writes under Run/RunOnce/services, and file writes to %APPDATA%/%TEMP%/startup, indicate persistence and staged payloads.

Step 4: Build the behavioral profile

Map observed operations to ATT&CK techniques and defang any network endpoints.

Validation

  • The process tree reconstructs from Process Create events.
  • File and registry writes are categorized with their target paths.
  • Observed behaviors map to specific ATT&CK techniques.

Pitfalls

  • Treating noisy read operations as significant — writes and creates carry the signal.
  • Missing short-lived child processes that exited before capture stopped.
  • Ignoring path normalization (%TEMP% vs absolute) when deduplicating.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.