The State of Malware Analysis: Advice from the Trenches

What malware analysis approaches work well? Which don't? How are the tools and methodologies evolving? The following discussion--captured as an MP3 audio file--offers friendly advice from 5 malware analysts. These are some of the practitioners who teach the reverse-engineering malware course (FOR610) at SANS Institute:

  • Jim Clausing: Security Architect at AT&T and Internet Storm Center Handler (Panelist)
  • Evan Dygert: Senior Security Engineer for Blue Cross Blue Shield Association (Panelist)
  • Anuj Soni: Senior Threat Researcher at Cylance (Panelist)
  • Jake Williams: Principal Consultant and Founder at Rendition InfoSec (Panelist)
  • Lenny Zeltser: CISO at Axonius and Maintainer of the REMnux distro (Moderator)

We covered the following questions. Here's where you can find each of them in the recording, in case you'd like to jump to a specific topic:

  • Which malware family or sample do you consider representative of or pivotal to a particular time period? (1:05)
  • How has your approach to examining malware changed over the years? (7:17)
  • What role do automated sandboxes play in the analysis process? (14:30)
  • What are your go-to tools for code-level analysis? (20:15)
  • Which malware analysis tools are useful for people who are just getting started with this type of work? (27:21)
  • What advice do you have for analyzing malware that's not a standard compiled Windows executable? (34:55)
  • How often do you see malware that uses a technique you consider innovative? (39:01)
  • Is endpoint security software becoming more effective at detecting malware? How are malware authors evading detection? (41:30)
  • What aspects of malware analysis have become easier? What's getting harder? (46:06)
  • What are the career paths for individuals who analyze malware for a living? (53:52)

Many thanks to Jim, Evan, Anuj, and Jake for sharing their insights during this panel discussion, which I had the privilege of moderating. If you'd like to strengthen your malware analysis skills, take a look at the FOR610 course we teach at SANS Institute.


About the Author

I design security solutions and shepherd them to a sustainable state. I used to be hands-on in many areas of cybersecurity and IT. Now I focus on strategy and leadership, treating security as an enabler that helps people and companies achieve their goals. As the CISO of Axonius, I lead the security program to earn customers' trust and fuel the company's growth. Earlier, I built security products and services. I'm also a Faculty Fellow at SANS Institute, where I help professionals develop malware analysis skills.

Learn more