Malware Triage

The problem this solves

Malware triage is the 30-minute assessment between "we found a suspicious file" and "here's what the IR team needs to know." It's not reverse engineering — you don't disassemble the binary, trace execution paths, or decode custom protocols. Triage extracts surface-level indicators from file properties, embedded strings, PE structure, sandbox behavior, and reputation services. Those indicators feed containment decisions, YARA rules, network blocks, and the IR report.

Most practitioners either skip triage entirely (sending the file to a sandbox and waiting) or over-invest (spending hours in IDA Pro when 15 minutes with PEStudio would answer every question the SOC needs). This skill builds the middle ground — methodical triage that's thorough enough for IR and fast enough for active incidents.

What you will be able to do

1. Examine a suspicious file's static properties — PE headers, section characteristics, imports, strings, embedded resources — and classify it as likely malware, likely benign, or needs further analysis within 15 minutes.

2. Use hash-based reputation lookups across VirusTotal, MalwareBazaar, and threat intelligence platforms to determine if the sample is known, what family it belongs to, and what prior analysis exists.

3. Execute samples safely in a sandbox (ANY.RUN, Triage, Joe Sandbox) and read the behavioral report: process creation, file system changes, registry modifications, network connections, and dropped files.

4. Extract actionable IOCs from both static and behavioral analysis: file hashes, C2 IPs/domains, mutex names, registry paths, dropped file names, user agents — packaged for immediate use by the IR team.

5. Write a triage report that answers the five questions every IR team needs: what is it, what does it do, how bad is it, what should we block, and do we need deeper analysis?

Skill at a glance

Format: Ridgeline Skill — focused, practical, one topic

Sections: 5 content sections + guided lab

Tier: Premium subscription

Prerequisites: Basic understanding of PE file format (if you've seen a file header in a hex editor, you have enough). The Practical IR course gives you the investigation context, and the YARA skill teaches how to turn triage findings into detection rules.

Typical pace: 1-2 weeks at a few hours per week

What you leave with

Triage checklist: A step-by-step static + behavioral triage workflow you can execute against any suspicious file in under 30 minutes.

IOC extraction template: A structured format for packaging indicators from triage — ready to hand to the SOC for blocking or to the detection engineer for rule creation.

Triage report template: The 5-question report format that gives the IR team everything they need to make containment decisions without waiting for a full reverse engineering report.

Where triage fits in your workflow

Triage sits between evidence collection and deep analysis. During an IR engagement, you recover suspicious files from KAPE collections, memory dumps, or endpoint sweeps. Triage tells you what each file is and what it does — fast enough to inform containment decisions. The IOCs from triage feed into YARA rules (YARA skill), Sigma detections (Sigma skill), and network blocks.

What this skill is not

This is not a reverse engineering course. You will not use IDA Pro, Ghidra, x64dbg, or any disassembler. You will not trace execution paths, decode custom protocols, or write decompiler plugins. Those skills require months of dedicated study and are needed by malware analysts, not IR practitioners. This skill teaches the triage layer that 90% of practitioners need for 90% of incidents.