eni-malware-ir-workflow

仅文档：本 Skill 提供方法与检查表，不宣称自带可执行脚本。

Malware IR Workflow

Hash and preserve samples. Use capability-first triage, static reverse analysis, and Volatility-style memory context. Separate observed facts from hypotheses. Build a timeline, IOC package, confidence labels, and verification notes.

Persist checkpoints before long runs. Record commands, versions, hashes, evidence paths, assumptions, and verification results. Chain through eni-universal-workflow and finish with delivery.