Hello, security researchers π΅οΈββοΈ
Last time, we learned how to open a Hello World program with Ghidra and ask AI simple questions. But you know, AI doesn’t always understand perfectly. If you casually ask, “Explain this code,” AI will also casually reply, “It’s just C language code.” We call this GIGO (Garbage In, Garbage Out). ποΈ
Today, we’ll learn about the secret to getting 10 times more accurate and in-depth analysis results than others, even when using the same AI: ‘Security-Specialized Prompt Engineering.’ We are no longer mere questioners; we are becoming ‘Prompt Engineers’ who direct AI! π
1. What is Prompt Engineering? π€·
A prompt refers to a ‘command’ or ‘question’ given to AI. Prompt engineering is “the technique of meticulously designing questions to make AI produce the best possible answer you desire.”
In malware analysis, a good prompt has the following structure:
β¨ Magic Formula: [Persona (Role)] + [Context (Background)] + [Data (Code)] + [Instructions (Goal)] + [Output Format]
Shall we break down this formula one by one?
2. STEP 1: Setting the Persona (Who are you?) π
Assigning a role to AI significantly changes the quality of its answers. If you just ask, it will answer at a ‘generalist’ level, but if you give it an expert role, it will analyze in depth using specialized terminology.
- β Bad Example: “What is this code?”
- β Good Example: “You are a Senior Malware Analyst with 10 years of experience. Please answer from the perspective of security monitoring and incident response (CERT).”
When given such a role, AI suddenly changes its approach and strives to find key security information such as ‘attacker’s intent’ and ‘IoC (Indicator of Compromise).’
3. STEP 2: Question Optimization Practice (Before & After) π§ͺ
Let’s compare with an example of ‘socket connection (network communication)’ code commonly found in actual malware.
π Code to Analyze (C Language)
// Code snippet to analyze
WSADATA wsa;
WSAStartup(MAKEWORD(2,2), &wsa);
s = socket(AF_INET, SOCK_STREAM, 0);
addr.sin_family = AF_INET;
addr.sin_port = htons(4444);
addr.sin_addr.s_addr = inet_addr("192.168.0.10");
connect(s, (struct sockaddr*)&addr, sizeof(addr));π± [Before] Beginner’s Question
Prompt: “Explain the code below.”
>
AI’s Answer (Example): “This code initializes Windows sockets and attempts a TCP connection to IP 192.168.0.10 on port 4444. It uses the socket and connect functions.”
π Problem: While not incorrect, it lacks information on why this is dangerous or what an analyst should do. It merely ‘translated’ the code.
π€© [After] Applying Prompt Engineering
Prompt: “Role: You are a cybersecurity expert. Context: I have extracted the following code snippet from a suspicious executable. This code is presumed to have been executed without the user’s consent. Goal:
>
1. Analyze the behavioral purpose of this code. (e.g., backdoor, downloader, etc.)
2. Infer what the attacker intends to achieve with this code.
3. Extract network IoC (Indicator of Compromise) information that an analyst should block. Format: Summarize the key points in bullet points.
>
Code: [Paste code here]”
AI’s Answer (Example): π Security Analysis Report
>
– Behavioral Analysis: This code is a typical attempt at a Reverse Shell or C2 (Command & Control) server connection. It actively establishes a connection to a specific IP.
– Attacker’s Intent:
– Establish a communication channel with an external attacker server (C2)
– Await download of additional malicious payloads or reception of remote control commands
– Key IoC (Needs Blocking):
– Target IP: 192.168.0.10 (Appears to be an internal network IP, but in a real attack, it would likely be a public IP)
– Target Port: 4444 (Frequently used as a default port by hacking tools like Metasploit π©)
π Difference: Do you see it? It provides insights like ‘Reverse Shell,’ ‘C2,’ and ‘Metasploit default port,’ not just a simple ‘connection’! This is the analysis we want.
4. Tip: Chain of Thought Questioning π
Don’t stop at just one question. You need to delve deeper based on AI’s answers.
- Counter-argue: “Is there no possibility that this is a legitimate network management program? Check for false positive possibilities.”
- Request a response: “Write a YARA Rule to detect this attack.”
- Request an explanation: “Summarize this threat in simple terms so that a junior security analyst can understand it.”
5. Save Your Own ‘Cheat Sheet’ Prompts πΎ
It’s hard to type long prompts every time, isn’t it? Save your own prompt templates in Notepad or Notion and use them.
[Template: For Malware Analysis]
Role: Senior Malware Researcher
Task: Analyze the following assembly/C code snippet.
Details:
1. Identify the malicious functionality (Keylogging, Ransomware, RAT, etc.).
2. Explain the logic step-by-step.
3. Highlight crucial API calls and their parameters.
Format: Markdown Table
Code:
[Insert Code Here]π Conclusion
Today, we learned how to tell AI “who (an expert)” it should be and “how (from a security perspective)” it should answer. This skill is a core competency applicable to all tasks, including malware analysis, report writing, and email responses.
Next time, we will use this technique to practice unraveling ‘obfuscated scripts’ that are difficult for humans to read, with the help of AI. Please look forward to it! π₯
If you have any questions, please leave them in the comments! π
Leave a Reply