Skip to content
Get packs

Guide · Agent skill

How to use the Bootkit and Rootkit Analysis agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the analyzing-bootkit-and-rootkit-samples agent skill, a playbook that an AI agent follows when investigating malware that runs below the operating system, such as bootkits in disk boot sectors or UEFI firmware. It is written for readers who have never used agent skills before. By the end you will know what the skill does, how to add it to your agent, how to ask for help with a natural request, and which tools and precautions the work requires.

Bootkit and Rootkit Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the skill ZIP. Download the ZIP file for the analyzing-bootkit-and-rootkit-samples skill from this page.
  2. 2Unzip into a skills folder. Unzip the file into ~/.claude/skills/ for personal use, or into .claude/skills/ inside your project.
  3. 3Or upload it in the Claude apps. In the Claude apps, open Settings, then Capabilities, then Skills, and upload the skill.
  4. 4Install the required tools. Make sure Python 3, a disk imaging tool, UEFITool, chipsec, Ghidra, Volatility 3 and sigcheck are available on the analysis machine.
  5. 5Describe the infection in plain language. Ask the agent for help with a specific symptom, such as an infection that survives reinstallation or a UEFI Secure Boot change.
  6. 6Acquire evidence from an offline copy. Follow the acquisition steps for MBR, VBR and firmware, and hash each dump before analysis.
  7. 7Record the findings. Document boot sector integrity, firmware modules, hooks, hidden processes and remediation options as the skill's final step describes.

What does the Bootkit and Rootkit Analysis skill make the agent do?

Once installed, the agent follows a structured workflow for investigating infections that hide below the operating system. The skill covers six stages: acquiring boot sectors and firmware, analysing MBR and VBR code for tampering, inspecting UEFI firmware modules for implants, looking for kernel-level rootkit behaviour in memory, verifying the boot chain, and documenting the findings.

The skill's own description says it applies when compromise survives OS reinstallation or when antivirus or EDR fails to detect malware despite clear signs of infection. It names known threats such as LoJax, BlackLotus, CosmicStrand, MoonBounce and ESPecter as reference points for detection.

Install the skill: download the ZIP and unzip it

Download the ZIP file for this skill from this page. Unzip it so that the skill folder sits in one of the locations below. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, you can upload the skill under Settings, then Capabilities, then Skills. The skill's files are SKILL.md, scripts/agent.py and references/api-reference.md. Check that all three are present after unzipping.

  • Personal install: ~/.claude/skills/
  • Project install: .claude/skills/ inside your project folder
  • Claude apps: Settings, then Capabilities, then Skills, then upload

How do you trigger the skill with a natural request?

You do not need a special command. Describe the situation in plain language and mention the boot level or firmware. The skill is meant for cases where a system stays infected after a reinstall, or where antivirus or EDR misses malware even though there are clear signs of compromise.

Good requests name the symptom and the evidence you have. Examples include a machine that is still infected after a clean OS install, a suspicion that UEFI Secure Boot was disabled, or a memory dump that shows hidden processes.

  • Our workstation still shows the same infection after we reinstalled Windows. Help me check the MBR and UEFI firmware.
  • Secure Boot was turned off on this laptop and EDR found nothing. Walk me through checking the EFI System Partition.
  • Here is a memory dump with processes that do not appear in the process list. Look for rootkit behaviour using Volatility 3.
  • Check whether this firmware dump has modules that differ from the vendor baseline.

What tools and setup does the work require?

The skill runs scripts and expects you to have the forensic tools installed. The source lists Python 3, disk imaging tools such as dd or FTK Imager, UEFITool and chipsec, Ghidra with 16-bit x86 support, Volatility 3, a bootable Linux live USB for offline analysis, and sigcheck from Sysinternals for Windows signature checks.

The skill does not use the network, according to its metadata. Its licence is Apache-2.0. The steps need raw disk access and firmware dumping, so do the work on a copy or an offline image where you can.

  • Python 3 (the helper script agent.py is Python)
  • dd or FTK Imager for acquiring MBR, VBR and disk sectors
  • UEFITool and chipsec for firmware analysis
  • Ghidra with 16-bit x86 support for MBR code
  • Volatility 3 for memory and kernel artifacts
  • Bootable Linux live USB for offline analysis
  • sigcheck from Sysinternals for Windows signature checks

Example workflow: check the MBR and partition table

The skill's Step 1 reads the first sector of the disk. Its Step 2 includes a Python helper that checks the MBR signature, which should be bytes 0x55AA at offset 510 and 511, and lists partition table entries. The skill's scripts/agent.py is described as a helper that reads and checks the MBR signature and partition table.

Check the device name before running any command. The examples use /dev/sda, and reading the wrong device can mislead an investigation. The dd commands only read from the source, but you should still confirm the device first.

dd if=/dev/sda of=mbr.bin bs=512 count=1

Safety notes before you run anything

The skill's own text says it is not for standard user-mode malware, because bootkits and rootkits need different techniques. Treat the examples as investigation steps for a qualified analyst, not as routine cleanup. Some steps dump firmware and read raw disks, and careless use can damage a system.

The skill's Step 1 says to record a firmware dump's integrity with sha256sum. Keep a hash of every acquired image so your findings can be checked later. Run the investigation from an offline copy or a live USB where possible, so the suspect system is not changed further.

  • Work on images or copies, not the only copy of evidence
  • Confirm device names such as /dev/sda before running dd
  • Record a SHA-256 hash of each dump
  • Do not use this skill for routine user-mode malware
sha256sum firmware.rom

What people use it for

  • Investigating a Windows machine that stays infected after a clean OS reinstall by checking MBR, VBR and the EFI System Partition
  • Reviewing a firmware dump with UEFITool to compare module GUIDs against a vendor baseline
  • Studying a known UEFI threat such as BlackLotus or CosmicStrand as a reference case
  • Looking for hidden processes or hooked system calls in a memory image using Volatility 3 plugins
  • Learning boot-chain and firmware analysis as a security student, with the skill's steps as a guide

Frequently asked questions

How do I install the bootkit and rootkit analysis agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project folder. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.

Is the bootkit and rootkit analysis skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. The forensic tools it relies on, such as Volatility 3, UEFITool and chipsec, are separate projects with their own licences, which you should check before use.

What do I need to run this skill?

You need Python 3, disk imaging tools such as dd or FTK Imager, UEFITool and chipsec, Ghidra with 16-bit x86 support, Volatility 3, a bootable Linux live USB, and sigcheck from Sysinternals for Windows signature checks. The skill runs scripts and does not use the network.

Can this skill clean up ordinary virus infections?

No. The skill states it is not for standard user-mode malware, because bootkits and rootkits need specialised techniques. For ordinary infections, use a different approach.

Is it safe to run the bootkit analysis steps on my own computer?

The steps need raw disk access and firmware dumping, and careless use can damage a system. Work on copies or offline images where possible, confirm device names before running commands, and record hashes of your dumps.

What are the alternatives to this skill for rootkit detection?

The skill's source does not compare itself with other products, so this page cannot make a comparison claim. Its scope is boot-level and firmware analysis, with Volatility 3 for memory, and it is most useful when you already plan to use those tools.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits digital forensics and incident response analysts, malware researchers and security students who need a structured playbook for boot-level and firmware infections. It is not suitable for routine malware on a normal user system, or for anyone without forensic tools and training, because the steps can damage a system if run carelessly.

Download the skill