Malware › Module 8 › Lesson 4
Lab — IOC Draft
Build IOC table and report draft from $MAL_LAB artifacts — typed IOCs, exec pulse, share-safe export.
Visual · t22_ioc_lab
Lab: IOC table + report draft from $MAL_LAB. Original Cyberlium.
Opening
Turn your timeline into something SOC can import — without attaching the binary to the email.
From YOUR Modules 6–7 net/proc lab pack: (1) build IOC table ≥10 rows covering hash, network, host types with confidence tags; (2) draft exec pulse and technical summary sections per report outline; (3) run share safely checklist on draft — redact paths/IPs; (4) export share-safe bundle: ioc.csv or markdown + report excerpt, NO live sample; (5) chmod 600 directory. Optional mentor review question list. No fabricating IOCs, no live binary attachment, no ransomware notes in share bundle. Sample source and legal chain sentence in report header.
1. IOC table build
Columns: Type, Value redacted, Confidence, UTC First Seen, Source (static/dynamic), Notes.
Cross-link each network IOC to timeline row ID.
Command guide
Try these commands — IOC table build
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IOC report template — https://www.cisa.gov/stopransomware (share with defenders) MITRE ATT&CK IOCs — https://attack.mitre.org/ (technique-linked indicators literacy) YARA as IOC — https://yara.readthedocs.io/en/stable/ (detection artifact)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal cat > "$HOME/cyberlium-lab/t22-mal/notes/ioc-report.txt" <<'EOF' sample: eicar.com.txt (benign lab) hashes: see ioc-hashes.txt strings: EICAR-STANDARD-ANTIVIRUS-TEST-FILE yara: rules/eicar.yar never: live malware IOCs from untrusted downloads EOF
Command — copy this
grep -E 'sample|hashes|never' "$HOME/cyberlium-lab/t22-mal/notes/ioc-report.txt" cat "$HOME/cyberlium-lab/t22-mal/notes/ioc-hashes.txt" 2>/dev/null | head -5
Primary tools to practice this lesson: grep, openssl. Reference sites: IOC report template (https://www.cisa.gov/stopransomware); MITRE ATT&CK IOCs (https://attack.mitre.org/); YARA as IOC (https://yara.readthedocs.io/en/stable/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Report draft
Cover: hash, source, $MAL_LAB scope. Exec: three sentences. Body: static+dynamic bullets. Integrity block signed.
Mark observed vs inferred in every finding bullet.
3. Share-safe export
Run checklist — if live sample in folder, remove before zip; hashes only.
Index file lists contents and redactions applied.
4. What you ship: IOC lab pack
IOC table ≥10 rows + report draft + share checklist signed — no live sample.
5. What you record before the next lesson
IOC lab pack path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
IOC lab deliverable includes live ransomware binary for 'context.'
Right
IOC lab pack share-safe from $MAL_LAB. Next: quiz.
Mission: IOC lab
1) IOC table ≥10 typed rows. 2) Report draft with integrity block. 3) Share checklist completed. 4) chmod 600 bundle.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum IOC rows for capstone?”
Knowledge Check
APPLY: IOC lab uses artifacts from:
Multiple choice
Knowledge Check
APPLY: True or False: Live sample in share bundle is OK if small.
True or False
Knowledge Check
APPLY: IOC table needs:
Multiple choice