MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:50Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 66:		Line 66:
	[[Category:Windows Malware\|012]]		[[Category:Windows Malware\|012]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/windows/malware_hunting/malware_hunting_beginner.md

2026-09-18T17:06:35Z

Import from cypat.guide: docs/windows/malware_hunting/malware_hunting_beginner.md

New page

{{Submit}}

-----

Author(s): carbonice

Last Updated: 07-1-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== Why do we care? ==

Practice images, especially the higher difficulty ones, are often riddled with malicious programs, DLLs, backdoors, services, configurations, and programs. Additionally, these techniques that are used also often leverage a security vulnerability to do what they need to do (example: a malicious DNS plugin was only installable because an unwanted user had the DNS Admin role).

== Finding the Easiest Malware ==

Some malware is easily discoverable because:

# The malware makes its presence known, like Desktop Goose. If it's actively bugging you, you know to look for it.
# It can be found within AutoRuns. See below.
# It can be found with a baseline MalwareBytes scan, as well as Windows Defender and other antiviruses.
# It isn't fileless... we will get to this eventually, haha.

== AutoRuns ==

A defender's best friend, at least for simpler cases. Autoruns can discover a wide variety of simple persistence mechanisms used by malicious programs to stay running:

* Registry keys such as HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, which run programs on system startup
* Context Menu Handlers, such as a malicious option when you right click a file
* Image hijacks, basically saying "You want to run this program, actually you are running this program instead." (often used to set up sethc or utilman backdoors, see [https://attack.mitre.org/techniques/T1546/008/ this])
* Scheduled Tasks
* Services
* Drivers

== Antiviruses ==

There are plenty of antiviruses that are easy and free to use. This includes:

# Windows Defender - make sure there are no exclusions prior to running the scan.
# Malwarebytes - note that this will override Windows Defender.
# Hitmanpro - note that this will set up a service.
# Bitdefender - note that this will override Windows Defender.
# Kaspersky Virus Removal Tool application - note it is banned in the US, so you may want to use a VPN.

== Practice ==

Any practice image beyond the beginner difficulty will have some form of malware. Take your pick! The Windows Persistence Image may be helpful, as it has 8 persistences. Malwarebazaar also has a ton of malware that you can practice with, just note that some malware uploaded may not be malware. Malwarebazaar also has a daily malware zip folder if you want to download a lot in one go.

-----

=== References, Further Reading, & Tools Mentioned ===

* https://attack.mitre.org/techniques/T1546/008/
* https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
* https://www.malwarebytes.com/mwb-download
* https://datalake.abuse.ch/malware-bazaar/daily/
* https://bazaar.abuse.ch/browse/

[[Category:Windows Malware|012]]
[[Category:Migrated from cypat.guide]]

Draft:Malware Hunting - Beginner - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/windows/malware_hunting/malware_hunting_beginner.md