Threat Landscape and Malware Analysis
What this domain tests
The threat domain tests whether you can classify malware, describe modern attack chains, and choose appropriate analysis evidence. Expect ransomware, fileless/LotL attacks, phishing, supply-chain compromise, APTs, and the difference between static and dynamic analysis.
Core rules
- Malware categories: virus needs a host; worm self-propagates; trojan disguises intent; ransomware encrypts or exfiltrates; rootkit hides persistence.
- Fileless and living-off-the-land attacks abuse PowerShell, WMI, scheduled tasks, and signed binaries. A clean file scan does not prove a host is clean.
- Static analysis examines hashes, strings, imports, and signatures without execution. Dynamic analysis runs the sample in a sandbox and observes process, file, registry, and network behavior.
- IOCs are artifacts (hash, IP, domain); TTPs describe adversary behavior and are more durable for detection.
- Reputation and sandbox verdicts are inputs, not final proof; evasion is common.
Worked example
An alert shows powershell.exe -enc <base64> launched by winword.exe. Reasoning: decode the Base64, inspect the parent-child relationship, and check for network callbacks. A Word-spawned encoded PowerShell command is highly suspicious even if the decoded script is obfuscated. Submit the document and script to a sandbox, capture process and network behavior, and search other endpoints for the same parent-child pattern. Blocking only the decoded IP is weak because attackers rotate infrastructure; a behavior-based rule on Office spawning PowerShell is stronger.
Traps
- Relying only on file hashes; polymorphic malware changes them.
- Calling every IOC a TTP.
- Assuming antivirus catches fileless attacks.
- Treating a sandbox “clean” verdict as definitive.
- Ignoring parent-child process relationships.