Malware triage
When it applies
You have a sample (a dropped binary, a macro-laden document, a suspicious script) or a live process
and need a fast verdict plus IOCs — not full reverse engineering, but enough to decide and to feed
detection/IR.
Why it works
Most samples reveal their nature cheaply: capabilities, embedded strings, and behaviour appear long
before you need a disassembler. Triage front-loads the cheap signals and only escalates to deep RE
when the verdict is still unclear — so you get IOCs fast without burning hours per file.
Method
- Handle safely: work in an isolated VM/network, never on a production host. Treat the sample as
live; don't double-click to "see what it does" outside a sandbox.
- Identify: hashes, file type (magic bytes, not extension), and a reputation check by hash
(not by uploading the file if it may be sensitive/targeted).
- Static, no execution:
capa for capabilities (persistence, injection, C2), FLOSS/strings
for URLs, IPs, mutexes, registry keys; for Office/PDF, extract and de-obfuscate the macro/JS
(olevba, CyberChef). PE: imports, sections, signing, compile time (pestudio).
- Dynamic, if needed: detonate in a sandbox; capture process tree, file/registry writes,
network. This confirms behaviour static analysis only hinted at.
- Extract IOCs & a rule: host IOCs (paths, mutexes, keys) and network IOCs (C2 domains/IPs);
write a YARA rule on stable internals (not a rotating hash) for hunting.
- Feed the pipeline: hand behavioural IOCs to
defense-threat-hunting and turn stable ones into
a detection; if it's live on a host, escalate to defense-incident-response. Deep dive →
reverse-eng-*.
Gotchas
- Uploading a targeted sample to a public multiscanner can tip off the adversary — hash-check first.
- Malware detects sandboxes (sleeps, VM checks) and stays dormant — a clean dynamic run isn't
clearance; weigh the static capabilities too.
- Hash-based rules rot instantly; write YARA on code/string internals that survive rebuilds.
Verify success
You have a supported verdict (malicious/suspicious/benign), a capability summary, host + network
IOCs, and a YARA/detection rule — enough to hunt for other affected hosts.
References
Mandiant/FLARE capa & FLOSS; YARA; pestudio; olevba (oletools); MITRE ATT&CK.
1---2name: defense-malware-triage3description: Safely triage a suspicious file or process — is it malicious, what does it do, and what IOCs does it yield — with static then dynamic analysis. Load for "is this file malware", "analyze this binary/script/document", "suspicious process on a host", or extracting IOCs for hunting/detection.4---56# Malware triage78## When it applies9You have a sample (a dropped binary, a macro-laden document, a suspicious script) or a live process10and need a fast verdict plus IOCs — not full reverse engineering, but enough to decide and to feed11detection/IR.1213## Why it works14Most samples reveal their nature cheaply: capabilities, embedded strings, and behaviour appear long15before you need a disassembler. Triage front-loads the cheap signals and only escalates to deep RE16when the verdict is still unclear — so you get IOCs fast without burning hours per file.1718## Method191. **Handle safely**: work in an isolated VM/network, never on a production host. Treat the sample as20 live; don't double-click to "see what it does" outside a sandbox.212. **Identify**: hashes, file type (magic bytes, not extension), and a reputation check by hash22 (not by uploading the file if it may be sensitive/targeted).233. **Static, no execution**: `capa` for capabilities (persistence, injection, C2), `FLOSS`/strings24 for URLs, IPs, mutexes, registry keys; for Office/PDF, extract and de-obfuscate the macro/JS25 (olevba, CyberChef). PE: imports, sections, signing, compile time (pestudio).264. **Dynamic, if needed**: detonate in a sandbox; capture process tree, file/registry writes,27 network. This confirms behaviour static analysis only hinted at.285. **Extract IOCs & a rule**: host IOCs (paths, mutexes, keys) and network IOCs (C2 domains/IPs);29 write a YARA rule on stable internals (not a rotating hash) for hunting.306. **Feed the pipeline**: hand behavioural IOCs to `defense-threat-hunting` and turn stable ones into31 a detection; if it's live on a host, escalate to `defense-incident-response`. Deep dive →32 `reverse-eng-*`.3334## Gotchas35- Uploading a targeted sample to a public multiscanner can tip off the adversary — hash-check first.36- Malware detects sandboxes (sleeps, VM checks) and stays dormant — a clean dynamic run isn't37 clearance; weigh the static capabilities too.38- Hash-based rules rot instantly; write YARA on code/string internals that survive rebuilds.3940## Verify success41You have a supported verdict (malicious/suspicious/benign), a capability summary, host + network42IOCs, and a YARA/detection rule — enough to hunt for other affected hosts.4344## References45Mandiant/FLARE capa & FLOSS; YARA; pestudio; olevba (oletools); MITRE ATT&CK.
NoorQureshi