2026-09-22 19:36 UTC
The analysis process includes four components. The analyst frames questions and validates findings. The AI agent executes the investigation. The MCP server encodes practitioner knowledge. The toolkit is a disposable REMnux VM. "Teaching Al to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server" by Lenny Zeltser at #blueteamcon (2/n)
Replies (1)
-
@PwnieFan@infosec.exchange 2026-09-22 19:37
Al ran this analysis end to end: unpacked and decoded the obfuscated batch script, rebuilt two hidden executables from fragments, decompiled Autolt scripts and wrote a decoder, recovered encrypted and compressed payload, matched it to the StealC malware family. 19 minutes, 39 tool calls, about $4 using Claude Opus 5. "Teaching Al to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server" by Lenny Zeltser at #blueteamcon (3/n)