Treguesit e Sjelljes

When you run a sample in a monitored sandbox, the flood of events is overwhelming unless you know what to look for.

The key categories are process activity (what processes are created, what parent-child relationships form), file system changes (what files are written, read, or deleted, particularly in %APPDATA%, %TEMP%, Startup folders), registry modifications (persistence keys like Run, RunOnce, Services, COM hijacks), network activity (DNS queries, HTTP/HTTPS connections, non-standard ports, beacon patterns), and API sequences that match known malicious behavior (VirtualAlloc + WriteProcessMemory + CreateRemoteThread). Process Monitor and Sysmon are the two workhorse tools for capturing these events on Windows. Process Monitor shows all file, registry and process events in real time with powerful filtering. Sysmon runs as a service and writes structured events to the Windows event log, where they can be collected by a SIEM. A well-configured Sysmon on every endpoint is one of the most cost-effective detection tools available today. For every dynamic analysis you perform, produce a short IOC list: hashes (SHA-256), dropped file names, registry keys, mutex names, C2 URLs and IPs, user-agent strings. These indicators feed into detection rules (YARA, Sigma, Snort/Suricata) and threat-intel sharing platforms (MISP) so the rest of your organization and community can benefit from what you learned.

Mjete dinamike:

• Process Monitor (Sysinternals) — file/registry/network I/O.
• Wireshark, Fiddler — trafik.
• Any.Run, Cuckoo Sandbox, CAPE — sandbox-e.
• Sysmon për regjistrim të detajuar.

Regjistrim me Sysmon + Procmon:

sysmon -accepteula -i sysmon-config.xml
procmon /Quiet /Minimized /BackingFile C:\procmon.pml /Runtime 120

Detonation në Cuckoo:

cuckoo submit sample.exe
cuckoo web &  # shfleto raportin

1. Dedeto një mostër (p.sh. benign keygen lab) dhe identifiko: file writes, registry persistence, network C2.
2. Shkruaj IOC-të në formatin STIX/OpenIOC.

• SwiftOnSecurity — sysmon-config.
• MITRE ATT&CK — TTPs mapping.