Defense Malware Triage

---
name: defense-malware-triage
description: >
  Safely triage a suspicious file or process — is it malicious, what does it do, and what IOCs does
  it yield — with static then dynamic analysis. Load for "is this file malware", "analyze this
  binary/script/document", "suspicious process on a host", or extracting IOCs for hunting/detection.
domain: defense
type: technique
stability: learning
modes: [defense]
severity: info
mitre: [T1204, T1027, T1059]
tools: [capa, yara, pestudio, floss, cyberchef, sandbox]
schema_version: 1
---

# Malware triage

## When it applies
You have a sample (a dropped binary, a macro-laden document, a suspicious script) or a live process
and need a fast verdict plus IOCs — not full reverse engineering, but enough to decide and to feed
detection/IR.

## Why it works
Most samples reveal their nature cheaply: capabilities, embedded strings, and behaviour appear long
before you need a disassembler. Triage front-loads the cheap signals and only escalates to deep RE
when the verdict is still unclear — so you get IOCs fast without burning hours per file.

## Method
1. **Handle safely**: work in an isolated VM/network, never on a production host. Treat the sample as
   live; don't double-click to "see what it does" outside a sandbox.
2. **Identify**: hashes, file type (magic bytes, not extension), and a reputation check by hash
   (not by uploading the file if it may be sensitive/targeted).
3. **Static, no execution**: `capa` for capabilities (persistence, injection, C2), `FLOSS`/strings
   for URLs, IPs, mutexes, registry keys; for Office/PDF, extract and de-obfuscate the macro/JS
   (olevba, CyberChef). PE: imports, sections, signing, compile time (pestudio).
4. **Dynamic, if needed**: detonate in a sandbox; capture process tree, file/registry writes,
   network. This confirms behaviour static analysis only hinted at.
5. **Extract IOCs & a rule**: host IOCs (paths, mutexes, keys) and network IOCs (C2 domains/IPs);
   write a YARA rule on stable internals (not a rotating hash) for hunting.
6. **Feed the pipeline**: hand behavioural IOCs to `defense-threat-hunting` and turn stable ones into
   a detection; if it's live on a host, escalate to `defense-incident-response`. Deep dive →
   `reverse-eng-*`.

## Gotchas
- Uploading a targeted sample to a public multiscanner can tip off the adversary — hash-check first.
- Malware detects sandboxes (sleeps, VM checks) and stays dormant — a clean dynamic run isn't
  clearance; weigh the static capabilities too.
- Hash-based rules rot instantly; write YARA on code/string internals that survive rebuilds.

## Verify success
You have a supported verdict (malicious/suspicious/benign), a capability summary, host + network
IOCs, and a YARA/detection rule — enough to hunt for other affected hosts.

## References
Mandiant/FLARE capa & FLOSS; YARA; pestudio; olevba (oletools); MITRE ATT&CK.