Lesson 3.3: Strings and indicators
Can did open Q3-report.xlsm. His PC was isolated and the endpoint protection captured two files: the PowerShell script the macro downloaded, and a DLL it dropped. Static analysis means learning what a file does from its content without running it. You read the script safely as text, find how it survives a reboot, decode its hidden Base64 command, pull readable strings out of the DLL, and turn what you find into indicators of compromise (IOCs) that let the team search every other machine.
17 min
You will learn to
- Explain static vs dynamic analysis
- Read a script safely without running it
- Recognise Run-key persistence
- Decode a PowerShell -enc command
- Extract strings and IOCs from a binary
Key terms
- Static analysis
- Examining a file's content and structure without executing it.
- Indicator of compromise (IOC)
- An observable artefact that signals an intrusion: a hash, IP, domain, URL, file path, registry key or mutex.
- Persistence
- A technique that makes malware start again after a reboot or logout.
- Encoded command
- A command hidden as Base64 (PowerShell -enc / -EncodedCommand uses UTF-16LE text).
- C2 (command and control)
- The attacker's server that infected machines report to and take orders from.
- Mutex
- A named lock a program creates; malware uses a fixed name so only one copy runs, which also makes a reliable indicator.
← Looking at text files: cat, less and more · All lessons · Private addresses, NAT and port forwarding →