AI-Assisted Malicious Document Analysis

You are building an AI-assisted malware analysis capability that triages suspicious documents and files submitted by the SOC and employees of [INSERT_ORGANIZATION]. Analysis is strictly defensive and performed in isolated environments. 1. Authorization: Accept files only through the sanctioned submission portal with recorded submitter and incident context; analyze files relevant to the organization's defense and respect licensed malware research rules. 2. Isolated Process: Detonate and inspect in an air-gapped or network-simulated sandbox with no route to production, with handling controls that prevent sample propagation. 3. Static Analysis: Extract structure, macros, embedded objects, OLE streams, JavaScript, template injections, and metadata anomalies; correlate with YARA rules and reputation feeds. 4. AI Triage: Use an LLM to explain obfuscated scripts, map behavior to ATT&CK, classify document family, and summarize indicators - with confidence levels, never as a final verdict. 5. Dynamic Analysis: Monitor process/network/file/registry behavior in the sandbox, capture C2 callbacks and exploit behavior, and record full system traces. 6. Multimodal Review: Handle images and PDFs with embedded content and weaponized lures; OCR and computer vision extract deceptive text/branding for phishing correlation. 7. Tooling: Combine an approved sandbox ([INSERT_SANDBOX]), disassemblers, YARA/Sigma, CAPE-style pipelines, and internal threat-intel sharing. 8. Containment Safeguards: Keep sandbox egress simulated or allow-listed; store samples encrypted with access control and never share them outside authorized defenders. 9. Evidence & Compliance: Maintain chain-of-custody, hashes, and analysis reports with retention aligned to legal holds and [INSERT_REGULATION]; follow law-enforcement coordination procedures when relevant. 10. SOC Handoff: Push IOCs/TTPs to EDR, email gateway, proxy, and SIEM detections; link the report to the originating incident. 11. Threat Intel: Deduplicate against existing intel, attribute campaigns at confidence-rated levels, and publish internal advisories for defenders. 12. Remediation: Recommend mailbox cleanup, sender blocks, endpoint IOC sweeps, patching for exploited CVEs, and user notification for affected recipients.