Week Overview

  • How malicious software gets code to run
  • Execution environments
  • Triggers and user interaction
  • The eternal problem of “how do I get this thing to actually start?”

The Starting Problem

  • Code that never executes is irrelevant
  • Every campaign must solve initial execution
  • Defenders focus heavily on this moment

Common Execution Contexts

  • User-launched processes
  • Scheduled tasks and services
  • Document macros and scripts
  • Browser or application plugins

Process Creation Basics

  • Parent-child relationships
  • Command-line arguments as artefacts
  • Environment inheritance

User-Triggered Execution

  • Double-click, open attachment, run installer
  • Social engineering still the most reliable method
  • User trust as the primary vulnerability

Automatic Execution Mechanisms

  • Autostart locations
  • Service installation
  • Scheduled tasks
  • Event-driven triggers

Document and Script Vectors

  • Office macros
  • Scripting hosts
  • Browser-based execution
  • Trust boundaries that users rarely notice

Environment Checks Before Execution

  • Sandbox and virtual machine detection
  • Locale, time zone, installed software
  • Decision to run, delay or abort

Triggers and Conditions

  • Time-based
  • Event-based (file open, network connect)
  • User presence or interaction
  • External command

Why Triggers Matter

  • Reduce unnecessary exposure
  • Align activity with target behaviour
  • Complicate dynamic analysis

Execution Traces

  • Process trees
  • File system changes
  • Registry or configuration modifications
  • Network connections

Evidence Generated by Execution

  • Logs that defenders can collect
  • Artefacts that survive reboot
  • Timing information that reveals automation

The “Just Start” Problem in Practice

  • Many samples fail simply because execution conditions are never met
  • Overly strict environment checks can prevent real infections
  • Balance between caution and reliability

Historical Execution Patterns

  • Early viruses: simple file infection
  • Later worms: network service exploitation
  • Modern: multi-stage loaders with heavy conditionality

Lab Preview — Execution Laboratory

  • Experiment with benign programs under different triggers
  • Capture and compare execution traces
  • Observe what evidence each mechanism produces

Practical Considerations

  • Privilege level at execution time
  • Persistence of the execution method itself
  • Ability to re-trigger after interruption

Common Failure Modes

  • Trigger that never fires
  • Environment check that is too aggressive
  • Dependency on a component that is blocked

Key Questions

  • What is the simplest reliable way to start?
  • What evidence does that method leave?
  • How would a defender notice the start?

Design Trade-offs

  • Stealth versus reliability of execution
  • Complexity of triggers versus maintainability
  • User interaction versus fully automatic start

Takeaways

  • Execution is the first mandatory success
  • Every method leaves traces
  • The “how do I start” problem remains central