This sequence introduces the methodology of analyzing malicious software to understand its behavior and origin. Students set up isolated lab environments to perform both static analysis (examining code without running it) and dynamic analysis (observing behavior during execution). The arc progresses from identifying file signatures to understanding obfuscation techniques and developing Indicators of Compromise (IOCs).
