Skip to content
Get packs

Bootkit and Rootkit Analysis

Guides an agent through analyzing MBR, VBR, UEFI firmware and kernel rootkit artifacts for deep-persistence malware.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent follows a structured playbook for investigating malware that hides below the operating system, such as bootkits that live in the disk boot sectors or UEFI firmware. It explains how to image those boot areas, check them for tampering and known bootkit signatures, inspect firmware modules, and look for rootkit traces in memory. It also includes a small Python helper that reads and checks the MBR signature and partition table.

Great for

  • Digital forensics or incident response analysts investigating infections that survive reinstalling the OS
  • Malware researchers studying known UEFI or boot-level threats
  • Security students learning boot-chain and firmware analysis

Skip it if

  • Routine malware on a normal user system, since the skill itself says standard user-mode malware needs different techniques
  • Non-experts without forensic tools or training, because the steps require raw disk access and firmware dumping and can damage a system if run carelessly

Try asking

  • “Analyze this MBR image for signs of a bootkit and report the partition table layout”
  • “Walk me through checking the UEFI firmware dump for unauthorized DXE drivers”
  • “Help me look for SSDT and hidden-process rootkit indicators in this memory dump”
  • “Verify the boot chain integrity of this Windows machine after suspected compromise”
Step-by-step guide: how to use Bootkit and Rootkit AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-bootkit-and-rootkit-samples.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-bootkit-and-rootkit-samples.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-bootkit-and-rootkit-samples.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on copies or offline images, never the live disk, and hash every acquired image before analysis
  • Confirm the exact tool versions and the vendor firmware baseline before comparing modules
  • Treat any scripts and commands the agent proposes as privileged operations and review them before running

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.