CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

Malware Analysis

PreviousSIEM and Event CorrelationNextCloud Models and Service Threats

Last updated 2 years ago

  • Signatures are not enough today.

  • Yara

  • MAEC

  • Sandbox – Running malware inside an isolated virtual environment

    • Mointor changes to system files

    • Monitor changes to processes and services

    • Network Activity

    • Low level system calls

    • File creation, change, deletion during execution

    • Scheduled tasks

  • Cuckoo Sandbox

  • Careful with hypervisor vulnerabilities

  • Reverse-Engineering: Figuring out how software works

    • Decompiler

      • Determine high level source code

      • Obfuscation

      • Pseudo-code

    • Disassembler

      • Binary to assembly code

      • Better file identification

      • Difficult to follow

    • String searching

      • Static string stored together

      • Reveals file names, domains, keys, etc

    • Program packers

      • Sort of a self extracting archive

      • Compression, obfuscation

  • Exploit Techniques – Methods used by malware to attack a target

    • Viruses

      • Infect files

      • Requires user interaction

    • Worms

      • Propagate over network

      • Does not require interaction

    • Fileless malware

      • Executable code passed through a script in a request

      • RAT dropper

    • Code injection

      • Shellcode

      • Masquerading

      • DLL sideloading, hijacking

      • Process hollowing – empty process that starts safe, but changes dynamically to malicious

    • “Living off the land”

      • Just a practice

      • Malware relies on existing tools on the host

      • Powershell, python, bash

Virus Total