SOC › Module 7 › Lesson 2
Detect Malware
Malware detection literacy — EDR alert, hash category, suspicious process chain — triage named class on $SOC_LAB sample alerts.
Visual · t29_detect_malware
Detect malware = named detection class literacy. $SOC_LAB. Original Cyberlium.
Opening
Malware alerts describe behavior and files — name the detection class on YOUR sample EDR rows, never how to build or deploy malware.
Malware detection literacy names: EDR prevention alert, suspicious process parent-child chain, known-bad hash category (lab TI stub), unsigned binary in user-writable path, scheduled task persistence category, and quarantine event row. Analyst triages $SOC_LAB sample EDR alert — cites observed process/file fields vs inferred impact — without writing malware, without disabling EDR on prod, without detonating samples on unauthorized networks. Cyberlium teaches defender vocabulary on instructor synthetic endpoint logs. Refused: malware authoring, unauthorized sample detonation, turning off AV/EDR on employer assets. Lab row: five malware indicator types with enrichment and disposition stub each.
1. Named malware indicators
EDR block, process chain, bad hash stub, suspicious path, persistence task — five literacy anchors.
Detection literacy — not malware development or deployment.
Command guide
Try these commands — Named malware indicators
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1204 — https://attack.mitre.org/techniques/T1204/ (user execution / malware) MITRE T1105 — https://attack.mitre.org/techniques/T1105/ (ingress tool transfer) Sigma malware — https://github.com/SigmaHQ/sigma/tree/master/rules/category/malware
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install curl
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
curl -sS https://attack.mitre.org/techniques/T1204/ | head -10
jq -c 'select(.category=="malware" or .category=="command-and-control")' "$SOC_LAB/logs/proxy.jsonl"
cat > "$SOC_LAB/notes/malware-detection-literacy.txt" <<'EOF'
Malware DETECTION indicators (YOUR lab logs):
- proxy block category malware (payload.bin — FAKE URL)
- C2 beacon pattern: block category command-and-control
- correlate with auth failures + rare external IPs
NEVER: download/run real payloads — detection literacy on seeded blocks only
EOFCommand — copy this
grep NEVER "$SOC_LAB/notes/malware-detection-literacy.txt"
Primary tools to practice this lesson: jq, curl. Reference sites: MITRE T1204 (https://attack.mitre.org/techniques/T1204/); MITRE T1105 (https://attack.mitre.org/techniques/T1105/); Sigma malware (https://github.com/SigmaHQ/sigma/tree/master/rules/category/malware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage discipline
Isolate host category in runbook literacy — lab stub only; enrich asset criticality from $SOC_LAB table.
Separate observed telemetry from inferred lateral movement.
3. Refused
No malware writing or unauthorized detonation; no disabling EDR as 'lab.'
Malware detection literacy supports triage — not offensive tooling.
4. What you ship: malware detection literacy card
Five indicator types + triage stub each + NEVER malware authoring line.
5. What you record before the next lesson
Malware detection literacy card path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write and run custom malware on lab network without brief authorization.
Right
Malware detection card from $SOC_LAB sample EDR alert. Next: Detect Brute Force.
Mission: malware detection literacy card
1) Name five malware indicator types. 2) One triage stub per type. 3) Apply to one sample EDR alert. 4) Write NEVER malware authoring line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Process chain — parent/child literacy?”
Knowledge Check
APPLY: Malware detection literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Malware authoring is course lab.
True or False
Knowledge Check
APPLY: EDR alert may include:
Multiple choice