# Site

## Pages

- [Page not found](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/404/): That page doesn't exist, or it has moved since you last looked
- [Assignment 1: My First Malware](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/assignment-1/): A fictional piece of malware, designed end to end and documented as a complete engineering artefact rather than a single hacking trick.
- [Assignment 2: Don't Get Caught](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/assignment-2/): A CTF-style practical requiring students to infect an assigned target machine, retrieve the flag, and remain undetected while doing so.
- [Final Examination](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/final-exam/): A two-hour, in-person written examination covering the full malware production lifecycle, analysis, detection and operational security.
- [Lab 1: From Idea to Threat Model](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-01/): Turn a fictional malware idea into a structured lifecycle and threat model, the first step before any design gets built.
- [Lab 2: Build a Malware Blueprint](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-02/): Design a modular malware architecture on paper, without writing a functioning payload.
- [Lab 3: Execution Laboratory](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-03/): Trigger benign programs by different execution mechanisms and read the traces those triggers leave behind.
- [Lab 4: Infiltration Investigation](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-04/): Investigate simulated phishing, vulnerability and supply-chain scenarios using prepared evidence.
- [Lab 5: Persistence Laboratory](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-05/): Detect and analyse simulated persistence mechanisms in a prepared virtual machine, without deploying real persistence.
- [Lab 6: Distribution & Infrastructure](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-06/): Design and analyse a simulated distribution infrastructure for a fictional malware campaign.
- [Lab 7: C2 Communications Laboratory](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-07/): Analyse captured command-and-control traffic and build a benign request/response simulator.
- [Lab 8: Malware Analysis Laboratory](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-08/): Analyse a deliberately benign sample using static and dynamic techniques, and separate observed from inferred behaviour.
- [Lab 9: Detection & Evasion Laboratory](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-09/): Test and improve signature-based and behavioural detection rules against benign simulated malware behaviours.
- [Lab 10: "How Did They Get Caught?"](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/assessments/lab-10/): Reconstruct a fictional actor from logs, metadata and operational-security mistakes, and assess the attribution evidence.
- [Opening lecture](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-01/): The first lecture, covering what the course is, why it is structured this way, and what happens in Week 1
- [From Idea to Malware](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-02/): How a threat model and a motivation become a working malicious program, traced through the malware development lifecycle
- [Malware Architecture](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-03/): The components a malware system is built from, and why that system increasingly resembles ordinary software
- [Execution](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-04/): How malicious code gets from sitting on disk to actually running, and the environments and triggers that make it happen
- [Infiltration](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-05/): How malware reaches a target environment in the first place, from social engineering to exploited software weaknesses
- [Persistence](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-06/): How malware survives reboots and interruptions, and why removing it is harder than finding it
- [Distribution](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-07/): Getting malware from its creator to its targets at scale, held at the semester's mid-point retro and assessment discussion
- [Command, Control & Communication](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-08/): How malware communicates with its operator once it is running, and what happens when that channel disappears
- [Malware Analysis](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-09/): Reverse engineering as an investigative process, from static and dynamic analysis to reconstructing intent
- [Detection & Evasion](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-10/): How defenders identify malware, and why its authors care so much about being noticed
- [Operational Security](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-11/): Attribution, infrastructure hygiene and the human errors behind famous operational-security failures
- [Review](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/lectures/week-12/): Connecting the semester's concepts across the malware production lifecycle, ahead of the final examination
- [People](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/people/): Who teaches the course, and how to reach them.
- [Dr. Anastasia Rusakova](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/people/anastasia-rusakova/): Dr. Rusakova tutors on distribution infrastructure, command-and-control tradecraft and the operational-security failures that expose it.
- [Professor Fulan Al-Fulani](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/people/fulan-al-fulani/): Professor Al-Fulani researches cyber operations, malware analysis and state-sponsored computing.
- [Professor Ivan Sidorov](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/people/ivan-sidorov/): Professor Sidorov researches malware production, hostile software infrastructure and the relationship between software engineering and malicious computing.
- [Dr. Marcus Whitfield](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/people/marcus-whitfield/): Dr. Whitfield tutors on malware execution, persistence and the detection engineering built to counter both.
- [Policies and support](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/policies/): The course-wide rules for late work, extensions, academic integrity and getting help.
- [Getting started](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/01-getting-started/): The first session of the semester, covering what malware is, what the course covers, and what a student is expected to bring to the practical work.
- [From idea to threat model](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/02-first-review/): The second session, where a motive becomes a threat model, and the malware development lifecycle gets its first outing.
- [Malware architecture](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/03-session/): Week 3 addresses the components of a malware system, and designing them as separate, replaceable modules rather than one binary.
- [Execution](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/04-session/): Week 4 covers how malicious software gets code to run at all, and the traces every execution method leaves behind.
- [Infiltration](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/05-session/): Week 5 covers how malware gets into a target environment, from social engineering to supply-chain compromise.
- [Persistence](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/06-session/): Week 6 addresses surviving reboots and interruptions, and why removing malware is harder than finding it.
- [Distribution](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/07-session/): Week 7 covers getting malware from creator to targets at scale, alongside a mid-semester retrospective and assessment discussion.
- [Command, control & communication](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/08-session/): Week 8 covers how malware talks back to its operator, and what happens when the server on the other end gets switched off.
- [Malware analysis](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/09-session/): Week 9 covers static and dynamic analysis, and reconstructing what a sample was intended to do.
- [Detection & evasion](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/10-session/): Week 10 covers how defenders identify malware, and why authors design around being noticed.
- [Operational security](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/11-session/): Week 11 addresses attribution, infrastructure hygiene and the human errors that end campaigns technical detection never caught.
- [Review](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-drvcarroll/sessions/12-session/): Week 12 connects the semester's lifecycle into one coherent picture, and prepares for the final examination.