noorqureshi/security-skills/defense-malware-triage

Malware triage

When it applies

You have a sample (a dropped binary, a macro-laden document, a suspicious script) or a live process and need a fast verdict plus IOCs — not full reverse engineering, but enough to decide and to feed detection/IR.

Why it works

Most samples reveal their nature cheaply: capabilities, embedded strings, and behaviour appear long before you need a disassembler. Triage front-loads the cheap signals and only escalates to deep RE when the verdict is still unclear — so you get IOCs fast without burning hours per file.

Method

1. Handle safely: work in an isolated VM/network, never on a production host. Treat the sample as

live; don't double-click to "see what it does" outside a sandbox.

1. Identify: hashes, file type (magic bytes, not extension), and a reputation check by hash

(not by uploading the file if it may be sensitive/targeted).

1. Static, no execution: capa for capabilities (persistence, injection, C2), FLOSS/strings

for URLs, IPs, mutexes, registry keys; for Office/PDF, extract and de-obfuscate the macro/JS (olevba, CyberChef). PE: imports, sections, signing, compile time (pestudio).

1. Dynamic, if needed: detonate in a sandbox; capture process tree, file/registry writes,

network. This confirms behaviour static analysis only hinted at.

1. Extract IOCs & a rule: host IOCs (paths, mutexes, keys) and network IOCs (C2 domains/IPs);

write a YARA rule on stable internals (not a rotating hash) for hunting.

1. Feed the pipeline: hand behavioural IOCs to defense-threat-hunting and turn stable ones into

a detection; if it's live on a host, escalate to defense-incident-response. Deep dive → reverse-eng-*.

Gotchas

• Uploading a targeted sample to a public multiscanner can tip off the adversary — hash-check first.
• Malware detects sandboxes (sleeps, VM checks) and stays dormant — a clean dynamic run isn't

clearance; weigh the static capabilities too.

• Hash-based rules rot instantly; write YARA on code/string internals that survive rebuilds.

Verify success

You have a supported verdict (malicious/suspicious/benign), a capability summary, host + network IOCs, and a YARA/detection rule — enough to hunt for other affected hosts.

References

Mandiant/FLARE capa & FLOSS; YARA; pestudio; olevba (oletools); MITRE ATT&CK.