Malware Triage

What Malware Triage teaches: taking an unknown file and producing a verdict somebody can act on, under time pressure, without reverse engineering it. Static examination, capability mapping, reputation, detonation, indicators, and the honest limits of each. Start here.

What a triage verdict is answering, how long you actually have and what that buys, the classes of thing that arrive in a queue, evidence integrity applied rather than described, and the first pass that decides whether a sample deserves the next twenty minutes.

Everything a file will tell you about itself before it runs: what it actually is, how it was compiled and prepared, whether it is packed, what a signature is worth, and the strings it did and did not intend you to see.

What a program can do, named and mapped to ATT&CK, from code that has never run. The technique most triage workflows omit, what its results are worth, and where it stops.

What other people already know: hash lookups, detection counts and what they establish, sample repositories, the submission decision, and the arithmetic of a clean result.

Running the sample yourself: the environment, what to capture, reading a behavioral report, and separating a sample that did nothing from one that decided not to.

Turning a verdict into something deployable: what to extract, which values survive the next build, writing a rule that holds, and handing over indicators somebody can actually use.

Running triage as a function rather than performing it once: the queue, the handoff, the boundary where triage stops, and what a triage practice looks like when it is working.

Six lookup pages for the commands that decide a triage item: identification, static reading, capability, reputation, detonation and indicators, each with what the result carries and what it does not.

Six runbooks for the procedures this work repeats: the four-minute pass, a novel sample, a packed one, an item feeding an incident, a sample that will not run, and the escalation.

Triage items reasoned end to end, including the ones that finish with a weaker verdict than the evidence first suggested and the one where the tooling was working perfectly and the reading was wrong.

Every practice surface available for this course, what each one gives you, where the gaps are, and the exercises worth building yourself.

Every command, verdict field, format and check from the Malware Triage course in one place, organized by task and linked back to the section that explains when not to use it.

The tools, documentation, sample sources and standards this course draws on, with what each is good for and where it goes stale.

Malware Triage end-of-course exam: a sample where every automated check is clean, testing whether you can establish capability statically, explain why four honest results were all wrong, and produce a verdict somebody else can evaluate.