Analyst Practice and Reporting

A capstone unit that ties the technical content of Units 1-6 to the analyst workflow expected in industry: IOC extraction and pivoting, MITRE ATT&CK technique mapping, and writing the analysis report that becomes the deliverable to defenders and decision-makers.

Learning outcomes

Apply IOC extraction and pivoting workflows using VirusTotal, MalwareBazaar, and threat intelligence platforms
Map observed malware behaviour to MITRE ATT&CK tactics and techniques with appropriate confidence
Produce a structured malware analysis report aligned with industry templates
Integrate Q1-Q6 technical knowledge into a defensible written deliverable

Topics

7.1

IOC Extraction and Pivoting

The first task after a sample lands on the analyst desk: extract Indicators of Compromise — file hashes, network artifacts, registry keys, mutex names, and YARA-matchable byte patterns. The second task is pivoting: using one IOC to find related samples, infrastructure, and campaign linkages through VirusTotal, MalwareBazaar, and OpenCTI.

25 min

7.2

MITRE ATT&CK Technique Mapping

MITRE ATT&CK is the industry-standard taxonomy for adversary behaviour. This topic covers how to map observed malware actions to the correct tactics and techniques, the difference between technique inference and technique observation, and the use of ATT&CK Navigator to communicate findings to defenders.

25 min

Practice & Play

Match

Analysis Report Match

6 pairs from this unit. Free to play. Earn 30 EZ Board points on your first clear.

Play

Assessments

Sign in to see your unlock progress.

Unit Assessment

Analyst Practice and Reporting

20 questions30 minPass: 60%

Start exam →

Comprehensive Assessment

REMA: Complete Assessment

7.3

Writing the Malware Analysis Report

The analyst report is the final deliverable: it tells defenders what to block, what to hunt for, and what the threat means in operational terms. This topic covers the standard report structure, the audience separation between executive and technical sections, and common reporting failures.

30 min

Sequence

The Cyber Kill Chain

7 steps from this unit. Free to play. Earn 30 EZ Board points on your first clear.

Play

Spot

Spot the IOC

8 items from this unit. Free to play. Earn 30 EZ Board points on your first clear.

Play

120 questions90 minPass: 60%

Start final exam →