0.3 The Environment You Will Build

This is the section to read before you download anything. Everything else in the course is reversible; a sample run on the wrong machine is not.

Handling, before tooling

Three things are true about live malware samples and all three are easy to skip past.

A sample is live until it is provably not. Not "probably old", not "already detected". Files in a triage queue are treated as capable of executing until they have been established otherwise, and the established-otherwise usually comes after the handling decision rather than before it. The ordering is the whole problem: you have to decide how to handle the file before you know what it is.

Possession has a legal position. It varies by jurisdiction and by employer, and it is generally fine for a security practitioner working within their role and not fine as a private individual collecting samples for interest. If you are doing this for an employer, the question is whether your organization knows and has agreed. If you are learning on your own equipment, use the deliberately safe sources in 0.6 rather than pulling live samples from a repository.

Sharing has a separate position again. Uploading a sample to a public multi-scanner makes it available to a large number of third parties. For commodity malware that is unremarkable. For a file that arrived in a targeted attack on your organization, it can disclose that you were targeted, and it can hand the actor confirmation that their sample was caught. Module 4 covers the decision properly; the point here is that it is a decision rather than a reflex.

None of that is legal advice and this course is not qualified to give any. It is the set of questions worth having answered before the first sample lands, rather than during the incident where somebody asks.

The practical version for most readers is short. If malware triage is part of your job, your employer has already accepted that samples exist on their equipment, and the thing worth confirming is where they are allowed to sit and who is allowed to move them. If it is not part of your job and you are learning, keep to samples built for teaching and you avoid the question entirely.

Isolation is a property you build

"Isolated VM" is said casually and means something specific. A virtual machine on your laptop is not isolated by virtue of being a virtual machine.

NETWORK      no route to your own network, no bridged adapter.
             Host-only or fully disconnected. NAT still reaches the
             internet and your gateway.
SHARED       no shared folders, no clipboard, no drag and drop.
             These are the ordinary route from guest to host.
CREDENTIALS  nothing signed in. No corporate account, no password
             manager, no browser profile, no mapped drives.
STATE        a clean snapshot taken BEFORE the first sample, and
             the discipline of reverting to it between samples.
HOST         a machine you would be willing to rebuild, not the
             one you also use for work.

The list is short and every line on it has been the thing somebody skipped. Shared folders are the most common, because they are convenient and because moving a sample onto the machine is the first thing you want to do. The safe route in is a file the guest pulls itself, or a disk image attached read-only.

The snapshot line is worth reading twice. Reverting between samples is not tidiness: without it you cannot tell whether an artifact on the machine came from the sample you are looking at or the one before it, and that ambiguity ruins the finding rather than merely inconveniencing you.

The credentials line has a subtler failure than it looks. People remember not to sign into email and forget that a browser installed from a synced profile carries saved sessions, or that a virtual machine cloned from a working image inherits whatever was mounted when the image was made. The check that works is opening the machine and looking for what is signed in rather than recalling what you put there.

Detonation is the only part that needs all of this

Worth being clear about proportion, because the requirements above put people off starting.

Modules 2, 3 and 4 examine files without running them. Static examination, capability analysis and reputation lookups are safe on an ordinary machine with ordinary care, and a large fraction of real triage never goes further than those three. You can work most of this course on the laptop you already have.

Ordinary care is doing some work in that sentence. Not double-clicking the file is the obvious part. The less obvious part is that some examination tools parse untrusted input in complex formats, and a document viewer opened to check what a PDF contains is executing a parser against a file built by somebody hostile.

Module 5 is the one that runs things, and everything above applies to it. Building the environment before you reach Module 5 rather than during it is the difference between a considered setup and one assembled at speed while a sample sits in a downloads folder.

There is a middle path worth knowing about. Online sandboxes run the sample on somebody else's infrastructure, which removes the environment problem and introduces the sharing problem instead: a file submitted to a public service is a file you have disclosed. For commodity samples that trade is usually fine and for a targeted one it usually is not, which is the decision Module 4 and Module 5 both return to.

The tooling

All free, and this is one of the few disciplines where the free tooling is genuinely what practitioners use rather than a compromise.

# Identification: what the file is, independent of its name
file sample.bin
die -e sample.bin
#
# Structure: headers, sections, imports, signing
pefile sample.bin
sigcheck -a sample.bin
#
# Strings, including those ordinary extraction never sees
floss sample.bin
#
# Capability, mapped to ATT&CK, without executing
capa sample.bin
#
# Detection
yara rules.yar sample.bin

REMnux ships most of this preconfigured, which is the fastest route to a working analysis machine and the one this course assumes. FlareVM is the Windows equivalent when you need to examine or run Windows binaries in a Windows environment.

The split between them is not arbitrary. Most static examination is comfortable on Linux regardless of what the sample targets, because reading a file's structure does not require the platform it was built for. Running it does, which is where a Windows analysis machine stops being optional for Windows samples.

Two of those tools deserve naming individually. FLOSS emulates the decoding routines inside a binary to recover strings that never exist in plain form on disk, so it sees what strings cannot. capa identifies capabilities at code level, mapping to ATT&CK and the Malware Behavior Catalog, and it is the single tool most missing from most triage workflows.

The distinction between those two is worth holding onto because it recurs. FLOSS recovers content the author tried to hide. capa recognizes patterns the author could not avoid leaving, since a program that makes an HTTP request has to contain the machinery for making one however the strings are treated. That is why capa keeps working on samples where string extraction has been defeated, and why a partial capa result on a packed file is still a result rather than a failure.

Commercial services appear where they are the realistic answer. VirusTotal, ANY.RUN and Joe Sandbox all have free tiers, and the course says which parts of each one a free account reaches, because a method that quietly assumes a paid subscription is not a method you can use on Monday.

Northgate Engineering

The fictional environment throughout is Northgate Engineering: an 810-person engineering firm with a security team of four, a shared triage queue, and enough happening that samples arrive from several directions.

The details are load-bearing rather than decoration. The queue has a backlog, which is why the cost ordering in this course matters. The team has no reverse engineer, which is why the handoff in Module 7 goes to an external party and has to be written for somebody with no context. And the estate is mixed enough that "we are not affected" is a claim requiring work rather than a glance.

A team of four also means the triage function is somebody's second job rather than their whole role, which is the ordinary case and the one that makes the time constraint real. A method that assumes a dedicated analyst with an empty afternoon is a method for an organization most readers do not work in.

The samples in the course examples are representative rather than harvested from a live campaign, and the course says so where it matters. What is never approximate is a tool name, a flag, a field name or a rule namespace: those come from the projects' own documentation.

What to do before Module 5

Three things, none urgent today.

Decide whether you are doing this for an employer or on your own account, because the answer changes the sourcing question in 0.6 and the sharing question in Module 4.

Build the machine, take the snapshot, and verify the network isolation by trying to reach something rather than by trusting the setting. A setting that says host-only and an adapter that answers a ping are two different claims.

And check the handling position with whoever owns it in your organization. That conversation is quick when nothing is happening and awkward when a sample is already on a disk.

If the answer to any of the three is unclear, that is worth knowing now rather than at the point of use. An analyst who cannot say where a sample is permitted to sit is an analyst who will eventually put one somewhere it is not, and the version of that conversation which happens afterwards is considerably longer.