Module Summary

What this module covered

0.1 set out the discipline. Triage answers four questions in dependency order: is this malicious, how bad and how urgent, what did it touch, and what do we look for everywhere else. None of them require knowing how the code works, which is why triage is a different discipline rather than a shallower reverse engineering. Its core is the four sentences that claim more than their evidence supports: the file is clean, the sample is inert, it communicates with this address, and we are not affected. In each case the tool worked correctly and the gap opened when a human widened the sentence.

0.2 mapped the course. Seven modules ordered by cost and dependency rather than by technique family, with two dependencies named because reversing them is expensive: capability before detonation, since a sandbox report is a list of what happened and you need to know what could have happened to read the gaps, and your own examination before reputation, since engine detection names come from automated classification and anchor hard.

0.3 covered the environment and the handling position. A sample is live until provably not, possession has a legal position that varies, and sharing has a separate one again. Isolation is five specific properties rather than a virtual machine, and only Module 5 needs all of them: static examination, capability analysis and reputation are safe on an ordinary machine with ordinary care, which itself needs qualifying, because opening a document to see what it contains runs a parser against a hostile file.

0.4 covered where triage shows up. The alert queue, where volume is the constraint and stopping early on ordinary items is the skill. The user report, where the control already failed and a clean reputation result is close to no information. The live incident, where the verdict is a service to somebody else's timeline and the trap is having it read as an incident scope. And the intelligence question, which runs backwards from a description to a checkable claim.

0.5 stated the limits first. A file cannot tell you what happened on a machine. Each of the four main sources fails by producing less output rather than wrong output, and less output reads as reassurance. A hash covers one exact build, in the places you looked, in the window your telemetry reaches. And triage stops where reverse engineering starts, which is a finished outcome rather than a failure.

0.6 got you running. REMnux for a working machine, a sample-sourcing order that starts with files that are not malware at all, five failures worth causing deliberately, and four habits worth having from the first queue item: verdict and confidence in one sentence, record what came back empty, capability and observation stated separately, and timebox the item before starting it.

What's next

Module 1 makes the discipline operational. What triage is answering in a real queue, how long you actually have and what that buys, the classes of thing that arrive and what each one implies, the handling and evidence-integrity position applied rather than described, and the first pass over a sample that decides whether it deserves the next twenty minutes.

It is the module that establishes the method everything after it refines, and the first section starts where every queue item starts: a file, a source, and no information you have not gone and got.