Gains:
- Understand static and dynamic analysis layers and be able to perform string triage, script annotation and IOC extraction with artificial intelligence
- Ability to flag patterns such as anomalies and beaconing in network traffic against baseline and verify each IOC
- Ability to understand that malware diagnosis is a hypothesis and that this information will only be used for defense and authorized investigation and cannot be used for unauthorized access or attack generation.
An incident often has malware at its center—software designed to damage a system, steal data, or take control. "What does this file do, how did it get into the system, what did it steal, where did it communicate to the outside?" The answers to these questions are critical for both understanding the incident and presenting it in court. Likewise, network forensics—tracing an event from network traffic records—reveals the attacker's entry and exit. In this unit, we will cover how AI is an accelerator in these two areas and should only be used for defense, verification, and authorized review purposes.
Border first: defensive use
The most important sentence of this unit is at the beginning: This information is for the sole purpose of defending your own system, investigating a case with authority, and verifying evidence. Using AI to produce working malware, intrude into someone else's system, or develop an attack is both illegal and unethical and is beyond the scope of this module. The forensic analyst reverse-engineers to understand and prove what the attacker did; not to repeat the attack.
Caution: Telling the AI "write me a working malware" or "how do I break into this system" is unauthorized use. Correct usage: "describe what this found instance does", "what does this traffic mean from a defense perspective", "how do I verify this IOC". The goal is always defense and evidence.
Two layers of malware analysis
Malware analysis is divided into two. Static analysis — examining the code and structure of the program without running it: file type, strings — readable texts inside the file, embedded URLs, called system functions. Dynamic analysis (dynamic analysis — running the program in an isolated environment and observing its behavior): usually performed in a sandbox (sandbox — an isolated safe environment where the malware is run without damaging the actual system); It monitors which files it creates, which registry keys it touches, and where it connects.
AI contributes explanation and prioritization at both layers:
- Marking suspicious URLs, commands and technical patterns in directories (strings).
- Explaining in plain language what a script or macro does.
- Summarizing sandbox behavior logs and extracting IOC (Indicator of Compromise: detection signals such as malicious IP, domain name, file hash, registration key).
- Outline of mapping known attack techniques to a framework (e.g., MITER ATT&CK — an open knowledge base that classifies attack tactics and techniques).
Each output is a hypothesis to be verified; Definitive diagnosis is made by proving the behavior in the sandbox and in the logs.
Network forensic analysis and AI
On the network side, you have PCAP (packet capture — the file where network traffic is recorded packet by packet), NetFlow/session records (who talked to whom, when, for how much time) and proxy/DNS logs. This data can be huge. AI:
- Flags unusual connections (unexpected country, port, duration).
- It detects and prioritizes periodic patterns such as beaconing (a malware sending an "I'm here" signal to the command server at regular intervals).
- Flags suspicious/fabricated domain name patterns (algorithm generated domain names) in DNS logs.
- It converts the traffic into a simple event narrative and produces a draft report.
Tip: When having the AI analyze traffic, define the normal baseline — the system's usual behavior: "This server normally only connects to the following countries on port 443." Anomaly only gains meaning in relation to the normal; Without a baseline everything looks suspicious and false positives explode.
Risk of hallucination and diagnosis
In malware analysis, AI hallucination is particularly dangerous: the AI may "see" a function call that doesn't exist, or misinterpret a string and say "this is ransomware." Diagnosis, however, should be supported by dynamic analysis (seeing behavior), verification of IOCs, and known signatures if possible. "The AI said so" is never enough to diagnose a malware family.
three mini cases
Case 1 — Macro analysis accelerated. The VBA macro in the Office document obtained in a phishing incident was complex and obfuscated. AI explained the steps of the macro in plain language: it deciphered a PowerShell command and downloaded the payload from a remote address. The analyst confirmed this hypothesis in the sandbox; The downloaded address was blocked as an IOC. Analysis went down from 3 hours to 40 minutes.
Case 2 — Beaconing captured. In the 6-hour NetFlow recording, the AI flagged small, regular connections to the same external IP every 300 seconds. The analyst confirmed that it was a command-and-control beacon and identified the compromised machine. The regular pattern was such that the human eye would miss millions of lines.
Case 3 — Return from misdiagnosis. AI looked at the strings of one sample and tagged it as “known X ransomware.” The analyst ran it in the sandbox: there was no encryption behavior, the sample was actually an infostealer. Dynamic verification prevented false family identifications from entering the report.
Four copyable templates
1) String triage:
Your role: defensive malware analyst. Below are strings extracted from the uniform. Mark suspicious URLs, IPs, file paths, commands, registry keys and technical indicators and write JUSTIFICATION. This is a hypothesis; not diagnostic. Generating working code; only comment out existing strings.
2) Script/macro description:
Describe this macro/script defensively: step by step what it does, what file/network/record access it has, is there any trace of persistence or data exfiltration? Link each assertion to a line in the code. Making the code executable or "improving" it; just explain. If you are not sure, mark it as "verify in sandbox".
3) IOC conclusion:
Below is a sandbox behavior log. Extract verifiable IOC candidates from here: IP, domain name, file hash, registration key, created file. Link each IOC to the line in the log. State that these are CANDIDATES for detection/blocking and confirmation is required.
4) Network anomaly marking:
Baseline: this server normally only talks to [country/service] from 443. I will give you session records. Based solely on what ACTUALLY happens in the recording: flag unexpected destination, port, duration, and periodic (beacon) patterns; Show each with the corresponding line. Do not claim causality; Comment from a defense perspective.
Weak prompt / Strong prompt
Weak prompt:
Tell me, is this file a virus?
No context, no verification; AI can look at the strings and come up with a precise but inaccurate diagnosis.
Powerful prompt:
Your role: defensive malware analyst. I'll give you an example's static indicators (file type, strings, APIs called) and a summary of sandbox behavior. Task: suggest a possible category (e.g. downloader, hacker, ransomware) as HYPOTHESIS based on observed behavior; Link each hypothesis to a concrete indicator. Giving a definitive family diagnosis; List dynamic verification steps. Comment only defensively.
The reliance on observation, the “hypothesis,” the verification step, and the defensive constraint make the output both useful and ethical.
Analysis layers table
layer
what sees
AI contribution
verification
static
Strings, structure, API
Suspicious indicator marking
manual inspection
Dynamic
work behavior
Log summary, IOC inference
sandbox observation
Network (PCAP/flow)
traffic patterns
Anomaly/beacon marking
Baseline confirmation
correlation
multi source
narrative outline
cross evidence
Common mistakes
- Assuming a static diagnosis is definitive. Family diagnosis should be confirmed by dynamic behavior.
- Searching for anomalies without a baseline. Without defining normal everything becomes a false positive.
- Blocking IOC without verification. False IOC intercepts legitimate traffic; confirm.
- Producing/requesting an attack from the AI. Unauthorized use; only defense and verification.
- Running the pest without insulation. Dynamic analysis is always done in isolated sandbox.
In summary
Malware and network forensic analysis reveals the technical core of an incident. AI; It greatly speeds up string triage, script/macro annotation, IOC extraction, and network anomaly flagging. But a diagnosis is a hypothesis; dynamic analysis, baseline and IOC verification are human work. And most importantly: this information is for defense, authorized examination, and evidence verification only — never for unauthorized access or attack development.
Application task
Set up a script/macro annotation scenario in a safe, isolated environment (or on an imaginary instance). Apply the "script/macro description" and "IOC inference" templates; Connect and verify each IOC the AI extracts to the source. Then try to find a beacon pattern with the "Network anomaly marking" pattern in a sample session log and confirm with the baseline.
checklist
- [ ] I conducted the analysis for defensive/authorized review purposes only.
- [ ] I treated the diagnosis as a hypothesis and confirmed it with dynamic behavior.
- [ ] I only ran the malware in isolated sandbox.
- [ ] I interpreted the network anomalies relative to the baseline.
- [ ] I connected each IOC to the source and confirmed before blocking.