Dynamic triage in an isolated sandbox
You build an analysis environment cut off from the internet, observe a suspicious sample against fake network services, record its process, file and network activity and turn it into indicators defenders can use.
Level 401 · 14 lessons · 12 practice labs
Lessons
Building the environment
- Designing the lab: isolation, snapshots, rollback
- Fake DNS, HTTP and SMTP with INetSim and FakeNet
- Monitoring tools: process, file, registry and network capture
- Lab hygiene: preventing escape and resetting after every run
- Short task: prove the lab leaks no packets outside
Observing behaviour
- The first run: an observation log with a timeline
- The process tree, dropped files and persistence changes
- Network indicators: domains, user agent, beacon interval
- Spotting samples that evade analysis: sleeps and environment checks
- Short task: explain the difference between two runs of one sample
From indicators to defence
- Reading and verifying an automated sandbox report
- Sharing indicators in STIX and MISP formats
- From behaviour to detection: proposing Sigma and YARA rules
- Capstone: triage a suspicious attachment in the sandbox and prepare a defence pack
Practice labs
- Roll the analysis environment back from a snapshot: Return the environment to its clean state and verify no trace of the previous analysis remains.
- Set up the fake network services: Set up fake DNS and HTTP answers with INetSim and show a test request being caught.
- Prove no packet leaks outside: Capture at the environment's boundary and prove no packet reaches the outside network during the analysis.
- Keep the observation log as a timeline: Note the first run of the inert training sample second by second.
- The process tree and dropped files: List the process tree, dropped files and persistence changes after the run.
- Explain the difference between two runs: Compare the different behaviour in two runs of the same sample and explain causes such as delays or environment checks from observations.
- Extract the network indicators: Extract the domains the sample queried and its user agent from the capture.
- Measure the connection interval: Measure the interval of requests reaching the fake server and write the regularity value.
- Validate the automated report by hand: Validate five claims in a prepared sandbox report against raw logs and mark the wrong one.
- Write the indicators in STIX form: Turn three indicators into shareable STIX objects.
- Propose a Sigma rule from behaviour: Write a Sigma rule catching the observed process chain and test it against a sample log.
- Prepare the defence package: Examine the inert attachment in the isolated environment and deliver a defence package with indicator list, YARA and Sigma proposals.
About this course
You build an analysis environment cut off from the internet, observe a suspicious sample against fake network services, record its process, file and network activity and turn it into indicators defenders can use.
What you will learn
- Building the environment
- Observing behaviour
- From indicators to defence
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.