Course Review Overview

  • The malware production lifecycle
  • Connecting the semester’s concepts
  • Case-study review
  • Examination preparation

Lifecycle Recap — Idea to Threat Model

  • Motivation and constraints
  • Threat modelling as the starting engineering activity
  • Requirements that shape everything downstream

Lifecycle Recap — Architecture

  • Modular components
  • Loaders, payloads, configuration, infrastructure
  • Design for replacement and independent update

Lifecycle Recap — Execution

  • Getting code to run
  • Triggers, environments and the traces left behind
  • Reliability versus stealth at the starting moment

Lifecycle Recap — Infiltration

  • Initial access vectors
  • Social, technical, physical and supply-chain routes
  • Highest-risk moment for many operators

Lifecycle Recap — Persistence

  • Surviving normal system events
  • Multiple mechanisms and removal difficulty
  • Turning transient execution into ongoing presence

Lifecycle Recap — Distribution

  • Moving software from creator to targets
  • Infrastructure chains and scaling
  • Failure points and redundancy

Lifecycle Recap — Command and Control

  • Communication with operators
  • Channels, resilience and the consequence of server loss
  • Patterns that enable detection

Analysis Perspective

  • Static and dynamic methods
  • Indicators of compromise
  • Reconstructing intent under uncertainty

Detection and Evasion Perspective

  • Signatures and behavioural methods
  • Continuous adversarial adaptation
  • Why remaining unnoticed matters

Operational Security Perspective

  • Attribution evidence
  • Infrastructure hygiene and metadata
  • Human error as the frequent decisive factor

Connecting the Concepts

  • Each stage constrains and informs the others
  • Architecture decisions appear in analysis and detection
  • OPSEC failures can nullify technical sophistication

Case-Study Synthesis Method

  • Select a documented campaign
  • Map observed elements to lifecycle stages
  • Identify strongest and weakest engineering choices
  • Note decisive OPSEC or detection events

Common Patterns Across Campaigns

  • Social engineering remains reliable
  • Infrastructure reuse is a recurring weakness
  • Simple quiet designs often outlast complex noisy ones

Assessment 2 Reminder

  • Don’t Get Caught — CTF-style practical
  • Infect, retrieve flag, establish persistence, avoid detection
  • Report covering OSINT, reconnaissance, infection, persistence, communication and avoidance

Final Examination Structure

  • Two-hour in-person written examination
  • Coverage of full lifecycle, analysis, detection and operational security
  • Emphasis on coherent reasoning over memorisation of trivia

Examination Preparation Advice

  • Be able to explain each lifecycle stage and its trade-offs
  • Practise mapping a scenario onto the full production path
  • Distinguish observed fact from inferred intent
  • State confidence levels when discussing attribution

Key Questions for Revision

  • How does motivation shape architecture and OPSEC requirements?
  • Which stage is most likely to generate detectable artefacts?
  • What single OPSEC failure would be most damaging to a campaign?
  • How do analysis and detection mirror production decisions?

Course Values Restated

  • Malware treated as a serious software production problem
  • All practical work remains deliberately benign and simulated
  • Curiosity and clear reasoning valued over sensationalism

Final Takeaways

  • A coherent course is one idea explored across a semester
  • Technical capability without operational discipline fails
  • Understanding the full lifecycle is more valuable than any single technique

Questions and Clarifications

  • Open floor for remaining conceptual questions
  • Clarification of assessment expectations
  • Administrative notes for the examination

Close

  • Thank you for treating a farcical subject with appropriate seriousness
  • Good luck with the remaining assessments and examination