Day 1: Understanding What the Malware Is Doing

Distinguishing Malware Types

• Distinguish common viruses and worms
• Understand ransomware behavior patterns
• Recognize malicious Trojan programs
• Understand advanced stealth malware

Analyzing Malware Behavior

• Observe processes created by malware
• Monitor files changed during execution
• Analysis of outbound network communications
• Possible malware persistence mechanisms

Performing Static Analysis

• Inspection of basic file structure
• Extract embedded strings and indicators
• Referenced libraries and signatures
• Identify properties without execution

Day 2: Watching Malicious Behavior Safely

Performing Dynamic Analysis

• Isolated sample execution and observation
• Monitor actual system modifications
• Record generated network traffic
• Compare behavior across executions

Running Samples in Sandboxes

• Prepare an isolated analysis environment
• Configure required monitoring tools
• Execute samples without external connectivity
• Reset environment after analysis

Extracting Indicators of Compromise

• Collect hashes of malicious files
• Extract malicious domains and addresses
• Distinctive paths and files
• Record of searchable compromise indicators

Day 3: Turning Indicators into Threat Intelligence

Managing Intelligence Lifecycles

• Initial intelligence requirements and priorities
• Collect information from relevant sources
• Intelligence and assess quality
• Distribute findings and review value

Evaluating Intelligence Sources

• Assessment of historical source reliability
• Review freshness of provided intelligence
• Corroborate information through other sources
• Record of final confidence level

Formulating Hunting Hypotheses

• Turn threats into testable hypotheses
• Expected supporting evidence in response
• Preferred required data sources
• Set criteria for hypothesis confirmation

• Peer-review the integrity of work involving Distinguishing Malware Types
• Practice Performing Dynamic Analysis through a field-based exercise
• Discuss a complex case involving decisions about Managing Intelligence Lifecycles
• Use an analytical activity to challenge assumptions in Formulating Hunting Hypotheses