Triage a benign artefact statically, then dynamically

short · 55 min · Objective 4.4

Task

Build an artefact whose behaviour you control, triage it as though you did not know, and discover what each analysis stage does and does not establish.

Steps

  1. Write a benign artefact that reads a file, makes one outbound connection to a local address, and writes a marker to disk. Then compress or pack it so its strings are not directly readable.
  2. Triage statically: file type, structure, readable strings, imports. Record what you could and could NOT determine in lab/static-triage.md.
  3. Run it in the isolated environment with observation, and record the behaviour in lab/dynamic-triage.md -- files, connections, processes.
  4. Add an environment check to the artefact so it does nothing when it detects the analysis environment. Re-run and record the clean result in lab/sandbox-evasion.md.
  5. Write one paragraph stating what a clean sandbox report actually establishes, and why it is not evidence of safety.

Verify

grep -Eci 'could not|not determined|packed|obfuscat' lab/static-triage.md
grep -Eci 'connection|file|process' lab/dynamic-triage.md
grep -Eci 'no behaviour|clean|nothing observed' lab/sandbox-evasion.md
grep -Eci 'one observation|not evidence|conditions' lab/sandbox-evasion.md

Static triage naming what it could not determine, dynamic triage naming real behaviour, and the evasion run producing a clean result WITH the caveat written. The pair is the lesson: a sandbox report showing nothing is one observation under conditions the sample may have detected.

Notes

Destroy the analysis environment afterwards and rebuild from a clean image, as you would for a real sample. The habit is the point even when the artefact is yours.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.