Script Static Analysis

In modern attacks, you're as likely to encounter malicious scripts as binaries. Nearly every attack chain involves at least one script somewhere in its lifecycle: Bash and PowerShell droppers, Python C2 agents, JavaScript or PHP backdoors, and so on. This room walks you through how to analyze and deobfuscate various scripts you will encounter in the real world.

Learning Objectives

• Learn why adversaries use scripts in cyber attacks so often
• Explore different defense evasion and obfuscation techniques
• Practice the skills by analyzing scripts taken from real-world attacks

Prerequisites 

• Complete the Intro to Malware Analysis room
• Know basics of scripting languages, such as JavaScript or Python
• Ideally, have some experience working in a blue team (e.g., SOC)

Lab Access

Before moving forward, start the lab by clicking the Start Lab Machine button below. The VM will open in split view and will need about 2 minutes to fully load. In case the VM is not visible, you can click the Show Split View button at the top of the page.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine