Detonate Safely
Controlled detonation in $MAL_LAB — observe behavior in isolated VM with logging, minimal interaction, revert after proof.
Visual · t22_detonate_safely
Lab: detonate safely in $MAL_LAB. Observe only. Original Cyberlium.
One intentional sample, one isolated VM, one observation window — not weaponizing what you saw for a forum post.
On YOUR $MAL_LAB per lab brief with legally obtained intentional sample: (1) verify hygiene card from prior lesson; (2) start process/network logging tools pre-configured in VM; (3) detonate sample using method allowed in brief — double-click, command line, or document opener as appropriate for file type; (4) observe 5–15 minute window: process creation, file drops, registry keys, DNS queries — capture redacted screenshots and UTC timestamps; (5) stop at proof of behavior categories, revert snapshot, do not iterate evasion or persistence on host. chmod 600 notes under $HOME/cyberlium-lab. No ransomware builder trials, no detonating stranger USB dumps without sourcing chain, no exfil of live sample to cloud casually.
1. Pre-detonation
Confirm sample hash matches brief manifest; hygiene card signed; logging tools running (Procmon-class, net capture optional).
Set UTC start time and expected observation window — time box prevents 'leave it running overnight on leaky network.'
Command guide
Try these commands — Pre-detonation
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Pre-detonation baseline — https://www.hybrid-analysis.com/ (compare to sandbox telemetry literacy) CISA IR — https://www.cisa.gov/stopransomware (baseline before incident)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || true journalctl --no-pager -n 25 2>/dev/null | tail -12 | tee "$HOME/cyberlium-lab/t22-mal/notes/baseline-journal.txt" ss -tulpn 2>/dev/null | head -10 echo 'never: run unknown samples on host OS' >> "$HOME/cyberlium-lab/t22-mal/notes/baseline-journal.txt"
Primary tools to practice this lesson: ss, journalctl. Reference sites: Pre-detonation baseline (https://www.hybrid-analysis.com/); CISA IR (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Observation focus
Record: parent process, child processes, file write paths, persistence attempts, DNS/HTTP destinations (redacted in notes).
Purpose is analyst literacy — name behavior classes for IOC and report rows, not reproduce malware for distribution.
3. Post-detonation
Stop VM, revert snapshot, verify host OS untouched; store redacted timeline chmod 600.
If sample source unclear or VM escaped containment, escalate to mentor — do not continue on host.
4. What you ship: detonate safely lab pack
UTC timeline + redacted behavior rows + snapshot revert proof + NO host OS line.
5. What you record before the next lesson
Detonate safely lab notes path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Detonate unverified download on host OS and screenshot for Discord.
- Right: Detonate safely lab pack from $MAL_LAB with revert proof. Next: Proc Monitor Literacy.
Mission: detonate safely lab
1) Verify hygiene and sample manifest hash. 2) Run logging tools; detonate in $MAL_LAB. 3) Capture ≥5 behavior rows with UTC times. 4) Revert snapshot; secure notes chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Observation window length for my sample class?”
APPLY: Detonate safely means:
APPLY: True or False: Detonation lab includes ransomware builder steps.
APPLY: After observation you must:
Proc Monitor Literacy
Part of Malware Analysis with AI — Dynamic Analysis Basics.
Lab — Dynamic
Part of Malware Analysis with AI — Dynamic Analysis Basics.
Quiz — Dynamic
Part of Malware Analysis with AI — Dynamic Analysis Basics.