SOC › Module 7 › Lesson 2
Detect Malware
Malware detection literacy — EDR alert, hash category, suspicious process chain — triage named class on $SOC_LAB sample alerts.
Visual · t29_detect_malware
Detect malware = named detection class literacy. $SOC_LAB. Original Cyberlium.
Opening
Malware alerts describe behavior and files — name the detection class on YOUR sample EDR rows, never how to build or deploy malware.
Malware detection literacy names: EDR prevention alert, suspicious process parent-child chain, known-bad hash category (lab TI stub), unsigned binary in user-writable path, scheduled task persistence category, and quarantine event row. Analyst triages $SOC_LAB sample EDR alert — cites observed process/file fields vs inferred impact — without writing malware, without disabling EDR on prod, without detonating samples on unauthorized networks. Cyberlium teaches defender vocabulary on instructor synthetic endpoint logs. Refused: malware authoring, unauthorized sample detonation, turning off AV/EDR on employer assets. Lab row: five malware indicator types with enrichment and disposition stub each.
1. Named malware indicators
EDR block, process chain, bad hash stub, suspicious path, persistence task — five literacy anchors.
Detection literacy — not malware development or deployment.
Command guide
Try these commands — Named malware indicators
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: jq, curl. Reference sites: MITRE T1204 (https://attack.mitre.org/techniques/T1204/); MITRE T1105 (https://attack.mitre.org/techniques/T1105/); Sigma malware (https://github.com/SigmaHQ/sigma/tree/master/rules/category/malware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage discipline
Isolate host category in runbook literacy — lab stub only; enrich asset criticality from $SOC_LAB table.
Separate observed telemetry from inferred lateral movement.
3. Refused
No malware writing or unauthorized detonation; no disabling EDR as 'lab.'
Malware detection literacy supports triage — not offensive tooling.
4. What you ship: malware detection literacy card
Five indicator types + triage stub each + NEVER malware authoring line.
5. What you record before the next lesson
Malware detection literacy card path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write and run custom malware on lab network without brief authorization.
Right
Malware detection card from $SOC_LAB sample EDR alert. Next: Detect Brute Force.
Mission: malware detection literacy card
1) Name five malware indicator types. 2) One triage stub per type. 3) Apply to one sample EDR alert. 4) Write NEVER malware authoring line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Process chain — parent/child literacy?”
Knowledge Check
APPLY: Malware detection literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Malware authoring is course lab.
True or False
Knowledge Check
APPLY: EDR alert may include:
Multiple choice