312-39V2: Certified SOC Analyst v2

Question

The SOC team discovered a suspicious document file on a user’s workstation. During initial inspection, the document appears benign, but deeper analysis uncovers an embedded PowerShell script. The team suspects that the script is intended to download and execute a malicious payload. They need to understand the script’s functionality without triggering it. Which malware-analysis technique would be recommended for the SOC team to understand the PowerShell script’s functionality without executing it?

Explanation

Static analysis examines file-based artifacts such as embedded code, strings, and resources without executing the sample. It enables inspection of the PowerShell commands and any hardcoded download or execution behavior while avoiding activation of the payload.

Learn more

MITRE ATT&CK: Malware Content data component

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ13

Community Discussion