0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC extraction, MITRE ATT&CK mapping, and detection engineering.
A practical Blue Team malware investigation demonstrating how suspicious Windows executables can be analyzed safely inside an isolated laboratory using behavioral analysis techniques.
Rather than reverse engineering malware source code, this project focuses on observing runtime behavior, collecting host and network telemetry, extracting Indicators of Compromise (IOCs), and mapping attacker activity to the MITRE ATT&CK framework.
Phase 1 — Secure Lab Setup
Phase 2 — Malware Detonation
Phase 3 — Host Behavior Analysis
Phase 4 — Network Behavior Analysis
Phase 5 — IOC Extraction
Phase 6 — MITRE ATT&CK Mapping
Phase 7 — Detection Opportunities
Phase 8 — Investigation Report
Examples include:
docs/
assets/
reports/
sigma/
splunk/
sentinel/
This repository is written as a real-world malware investigation rather than a collection of tool tutorials.
Every phase documents:
Whenever possible, conclusions are supported with screenshots, captured logs, and artifacts collected during malware execution inside the analysis laboratory.
This project is intended for defensive security education and malware analysis within isolated laboratory environments only.
