# Malware Analysis and Defense Course Assets

This directory contains the complete practice pack for the CodersSecret course **Malware Analysis and Defense for Developers**. Every artifact is instructor-authored, inert, synthetic, sanitized, or source-visible benign code. The pack contains no live malware, exploit, credential, persistence mechanism, propagation mechanism, command-and-control implementation, evasion technique, destructive behavior, or weaponized document.

## Safety classification

| Classification | Meaning | Assets in this pack |
| --- | --- | --- |
| Documentation | Instructions and safety boundaries only | This README and `behavior-contract.md` |
| Inert text | Plain text that has no executable behavior | YARA corpus and rules |
| Synthetic telemetry | Fictional events that were written for the course | Endpoint, Sigma, network, memory, tabletop, and capstone data |
| Benign source | Reviewable code with a fixed harmless behavior contract | `benign-telemetry-demo.ts` |

The JSONL network evidence uses only `.invalid` or `.example` names and the three IPv4 TEST-NET documentation ranges. The STIX bundle contains toy observables only. It must not be imported into a production blocking system.

## Directory guide

| Path | Purpose |
| --- | --- |
| `defensive-evidence-pack.json` | Entry point and cross-module evidence index |
| `yara/` | Harmless positive, near-match, and negative fixtures plus starter and expected rules |
| `endpoint/` | Synthetic process, file, identity, and network events |
| `sigma/` | Starter and expected Sigma rules with labeled positive and negative events |
| `network/` | Sanitized flow, DNS, HTTP-metadata, and TLS-metadata records; not a replayable capture |
| `memory/` | Sanitized observations only; no memory image or raw strings |
| `static/` | Trusted and altered PE, ELF, package, and script metadata; no binaries or packages |
| `benign/` | Transparent C source, fixed input, and build contract; learners build their own temporary copy |
| `frameworks/` | Version-pinned offline ATT&CK v19.2 and D3FEND 1.5.0 defensive records |
| `tabletop/` | Incident cards and a fictional service map |
| `intelligence/` | STIX 2.1 toy bundle with a statement marking for FIRST TLP 2.0 `TLP:CLEAR` handling |
| `architecture/` | Fictional developer-tool trust-boundary packet |
| `capstone/` | Northstar evidence index and synthetic incident timeline |
| `fixture-manifest.json` | SHA-256 and byte length for every other asset in this directory |

## Safe workflow

1. Run `node scripts/validate-malware-course-assets.js` from the repository root.
2. Confirm that validation passes before opening an exercise asset.
3. Use only the file named by the lesson. Do not substitute a real suspicious artifact, employer data, browser profile, memory image, packet capture, package, or container.
4. Keep network adapters disabled for offline evidence exercises.
5. Treat every family label in the data as a hypothesis, never as a verdict.
6. Export only the report requested by the lesson and delete temporary working copies.

## Benign demo

Read `behavior-contract.md` and the complete `benign-telemetry-demo.ts` source before considering execution. The preferred path is the prerecorded `endpoint/synthetic-endpoint-events.jsonl` dataset. Execute the source only inside the dedicated disposable course VM when the lesson's isolation preflight passes and a preinstalled approved TypeScript runtime is available. Do not install tooling from the internet for this exercise.

The demo accepts no arguments or other input, opens no network connection, requests no elevation, changes no startup or security setting, and writes only three fixed files inside one new course directory under the operating-system temporary directory. It starts `node --version` as its single fixed child process and removes every file it created in a `finally` block.

## Stop conditions

Stop immediately if a file is absent, its SHA-256 differs from the manifest, an address is outside the approved documentation ranges, a domain does not end in `.invalid` or `.example`, the demo directory already exists, a privilege prompt appears, networking is observed, a security control changes, or any behavior differs from the contract. Preserve the validator output and use the prerecorded evidence instead.

These fixtures are training material, not a substitute for an organization's incident-response, privacy, legal, or evidence-handling process.