Eni Malware Ir Workflow

---
name: eni-malware-ir-workflow
description: "[DOCUMENTATION ONLY] [仅文档] Offline malware triage, capability analysis, memory forensics, timeline, IOC packaging, and incident-response workflow."
x-alice-class: reverse
---

> 仅文档：本 Skill 提供方法与检查表，不宣称自带可执行脚本。

# Malware IR Workflow

Hash and preserve samples. Use capability-first triage, static reverse analysis, and Volatility-style memory context. Separate observed facts from hypotheses. Build a timeline, IOC package, confidence labels, and verification notes.

Persist checkpoints before long runs. Record commands, versions, hashes, evidence paths, assumptions, and verification results. Chain through eni-universal-workflow and finish with delivery.