soc · beginner
Perform safe first-level malware triage using static evidence and a fictional case.
Login required to start this lab and save your progress.
Section 1 · 1 tasks
Triage is a bounded initial assessment: preserve evidence, establish scope, identify useful indicators, estimate severity, and decide whether specialist escalation is required. It does not attempt to prove every behavior or fully reverse engineer a sample.
Section 2 · 2 tasks
Record filename, size, cryptographic hashes, detected file type, metadata, readable strings, source, and related host or user observations. Treat extensions and names as claims until verified by file type or trusted metadata.
Section 3 · 1 tasks
Static analysis examines a file without running it: hashes, headers, metadata, imports, and strings. Dynamic analysis observes execution in a purpose-built isolated environment. Never execute an unknown file on the analyst workstation or a production host.
Section 4 · 3 tasks
Q3-Invoice.pdf.exe, 248 KB, SHA-256 2222…2222, type Windows PE executable. Strings include powershell, RunOnce, and updates.example.invalid. Simulated hash report: 9/70 detections. Email telemetry shows unexpected delivery to three users. A controlled behavioral report mentions a child PowerShell process and outbound DNS to the fictional .invalid domain. Do not execute the file.
