- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Security
File Analysis with YARA
In this lab, you are supporting an internal incident response investigation after a Linux system was found to contain suspicious files and scripts. As a precaution, the system has been removed from the network and handed over for deeper analysis. Your objective is to classify unknown files using static analysis and YARA rules, identify signs of obfuscation or packing, determine whether the artifacts indicate unauthorized tool transfer, and assess the capabilities suggested by the files. You will analyze file characteristics, entropy levels, and ingress-related artifacts to understand how the files were introduced, what techniques were used to evade detection, and what the activity may reveal about the attacker’s tooling and intent. Your findings will be summarized in a short analyst report to help guide containment actions and future detection improvements. This lab simulates post-compromise malware triage and classification activities and aligns with real-world adversary techniques, including: > * **T1587.001 – Develop Capabilities: Malware** > > Identifying custom malware loaders, staging scripts, and attacker-developed tooling through structural and behavioral analysis. > >* **T1105 – Ingress Tool Transfer** > > Detecting malware delivery mechanisms used to transfer tools and payloads into a victim environment. > >* **T1027 – Obfuscated Files or Information** > Identifying obfuscated scripts, encoded commands, and packed or encrypted payloads designed to evade static detection.
Lab Info
Table of Contents
-
Challenge
Perform Structural Malware Triage
Before writing detection logic, analysts must first understand the files they are investigating. In real-world incidents, malware rarely appears as a single obvious executable; instead, analysts encounter a mix of small loader scripts, larger payload binaries, and files that may ultimately prove benign.
In this objective, you will perform initial malware triage by examining recovered files, identifying their likely function, and determining whether they behave like loaders, payloads, or benign artifacts. This skill is foundational: good detection starts with good classification.
-
Challenge
Detect Obfuscation and Malware Delivery Mechanisms
For your second objective as a cybersecurity analyst, your role is to transform the insights gained during initial malware triage into practical detection logic using YARA. Based on the structural traits, strings, and patterns identified in the suspicious files, you will begin constructing rules that allow these characteristics to be reliably detected across multiple samples.
Rather than relying on file names or hashes, this objective focuses on behavioral and structural indicators that persist even when malware is modified or repackaged. By encoding these indicators into YARA rules, you are creating reusable detection logic that mirrors how analysts identify malware families, uncover related samples, and support ongoing threat hunting and triage efforts.
This objective aligns with the following MITRE ATT&CK techniques:
T1027 – Obfuscated Files or Information
T1105 – Ingress Tool Transfer
T1059 – Command and Scripting Interpreter -
Challenge
Identify Packed Malware Using Entropy Analysis
Using entropy analysis and YARA’s
mathmodule, you will compare known benign and suspicious files, identify high-entropy content, and validate detections while minimizing false positives. -
Challenge
The Last Objective
Welcome to the final objective! This is your last chance to experiment in the environment. Clicking End Lab will end this little world that flittered into existence just for you.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.