AI Malware Named

AI malware named literacy covers threat classes — LLM-assisted malware drafting, polymorphic suggestions, and autonomous agent abuse — threat literacy ONLY; refuse generation recipes.

AI Malware Named• Audio Walkthrough

00:00/03:42

Visual · t32_ai_malware_named

AI malware literacy. $AI_LAB only. Original Cyberlium.

Threat literacy names the class — Cyberlium refuses malware-generation recipes and teaches detection and refusal instead.

AI-assisted malware threats include: LLMs used to draft or obfuscate malicious code, autonomous agents executing harmful tool chains, and poisoned coding copilots suggesting backdoors. Defenders detect via code review, sandbox detonation, EDR behavioral rules, and refusing unsafe copilot output — literacy names patterns; students NEVER generate malware recipes on Cyberlium. Cyberlium writes AI malware threat card on YOUR $AI_LAB — named classes and detection signals only, explicit refusal of generation requests. Next: Threats Lab.

1. AI malware threat classes (named, literacy only)

LLM-drafted malware: attacker uses model to speed script writing — defender fix is output policy and IR, not student replication. Agent abuse: autonomous tool loop executes harmful commands — limit tool scope. Poisoned suggestions: compromised copilot plugin recommends malicious dependency.

On $AI_LAB, write threat card — three classes with detection signal each. Explicitly refuse any malware-generation recipe request.

Command guide

Try these commands — AI malware threat classes (named, literacy only)

═══ LINUX / macOS (Terminal Practice) ═══

Check system state and user context

Command — copy this

id
whoami
uname -a

Inspect network sockets listening for connections

Command — copy this

ss -tuln 2>/dev/null || netstat -tuln

Audit active processes

Command — copy this

ps aux | grep -v "\[" | head -15

═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information

Command — copy this

whoami /all
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion

Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATLAS (https://atlas.mitre.org/); CISA AI (https://www.cisa.gov/ai); OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why refusal is the correct lab response

Generating malware — even 'for education' — violates law, ethics, and Cyberlium scope. Analysts need vocabulary to recognize AI-assisted threats in SOC tickets and code review, not to publish working payloads.

Students practice refusal sentence: 'I name the threat class and detection path; I do not generate malware.'

3. Literacy ≠ malware-generation cookbooks

Forbidden: prompt cookbooks that output working ransomware, droppers, or C2 scripts; sharing malware LLM threads in class chat. Allowed: AI malware named card — classes, detection signals, refusal sentence on $AI_LAB.

Ship: AI malware threat card with explicit generation refusal. Next: Threats Lab.

4. What you ship: AI malware threat card for $AI_LAB

Three threat classes, detection signals, refusal sentence. NO generation recipes. chmod 600.

5. What you record before the next lesson

Date. AI malware threat card. $AI_LAB named. File t32-m05-l03-ai-malware-named.txt chmod 600.

6. Wrong vs right: stranger SaaS vs YOUR toy LLM

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Ask LLM to write ransomware 'for lab.' Share malware prompt cookbook in Discord.
Right: Write AI malware threat literacy card with refusal sentence for YOUR $AI_LAB. Next: Threats Lab.

Hands-on Exercise