Malware triage for CTI

CTI analysts are rarely expected to reverse engineer. They are expected to triage: reach a defensible judgement about family, capability, configuration and infrastructure, and know when to escalate to someone who does this full time.

Static triage

Everything here is done without executing the sample.

• Hashes — SHA-256 for identity. Fuzzy hashes (ssdeep, TLSH) for similarity clustering, which matters far more for intelligence than exact matching.
• File type and structure — confirm what it actually is rather than what the extension claims. For PE files: compile timestamp (trivially forged, still occasionally revealing), sections, and imphash for clustering by import table.
• Entropy and packing — high-entropy sections suggest packing or encryption. A packed sample is not automatically malicious; legitimate software packs too.
• Strings — the highest value-per-minute step. Look for URLs, domains, IPs, registry paths, mutex names, user agents, build paths and error messages. Extract wide strings as well as ASCII.
• Imports — the API surface tells you capability. Network APIs, process manipulation and injection primitives, crypto, registry persistence. A tiny import table usually means dynamic resolution, which is itself a finding.
• Signatures — YARA rules for family identification, and CAPA for capability mapping, which conveniently outputs ATT&CK technique mappings.
• Signing — is it signed, by whom, and is the certificate valid, revoked or stolen?

Dynamic triage

Execution in an instrumented, isolated environment. What you are collecting:

• Process behaviour — the process tree, injection into other processes, child processes spawned.
• Persistence — run keys, scheduled tasks, services, startup folder, WMI subscriptions.
• Filesystem and registry — what it drops and where.
• Network — DNS lookups, connection attempts, TLS characteristics, beacon interval and jitter, and the URI patterns of the C2 protocol.
• Configuration extraction — the single most valuable output. Many families store C2 addresses, campaign identifiers and keys in a decodable configuration block; public extractors exist for common families.

Turning triage into intelligence

The output of triage is not a report full of hashes. It is answers to questions someone has:

1. What family is this, and at what confidence? Vendor detection names disagree; base the call on structure, configuration format and code overlap, not on an antivirus label.
2. What can it do? Map capability to ATT&CK techniques — this is what detection engineering can act on.
3. Who does it talk to? Extracted infrastructure feeds the pivots in the Diamond Model.
4. Is it targeted or commodity? Hard-coded references to the victim, tailored lures or a narrow distribution pattern point one way; broad distribution and an off-the-shelf loader point the other.
5. What does it mean for us? Exposure, detection gaps, and the recommended action.

Where the line is

Escalate to reverse engineering when the family is unknown and the configuration will not yield; when custom cryptography or a novel protocol is in play; when the intelligence value justifies days rather than hours; or when a legal or attribution-critical judgement will rest on the code itself. Knowing where your competence ends, and saying so, is a senior behaviour rather than an admission.

Practise malware triage questions.