Chapter 6 — Operating systems and virtualization
Lesson map
Lesson 06 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Operating-system activity"]
N2["6.2 Virtual machines"]
N3["6.4 Suspicious files"]
N4["6.5 Containers"]
N5["6.6 Patching the analysis environment"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Operating-system activity"]
N2["6.2 Virtual machines"]
N3["6.4 Suspicious files"]
N4["6.5 Containers"]
N5["6.6 Patching the analysis environment"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX016"]
[Learning outcomes]
|
v
[6.1 Operating-system activity]
|
v
[6.2 Virtual machines]
|
v
[6.4 Suspicious files]
|
v
[6.5 Containers]
|
v
[6.6 Patching the analysis environment]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) relate operating-system activity to ATT&CK techniques; (2) use virtual machines safely for analysis tasks; (3) understand snapshots and isolation; (4) know what not to do with suspicious files.
6.1 Operating-system activity
Processes, services, scheduled tasks and accounts are where intrusions become visible. ATT&CK techniques such as Command and Scripting Interpreter (T1059) and Scheduled Task/Job (T1053) describe common behaviours. Endpoint logs recording process starts with command lines help confirm or rule out reported behaviour.
When MCX describes behaviour such as a scheduled task with a particular name, the endpoint logs are where CMS can check whether the same thing happened on its own machines. Command lines matter because the same program, such as a scripting interpreter, is used daily by administrators; the arguments are what separate routine maintenance from the behaviour described in a report.
6.2 Virtual machines
A virtual machine runs a separate operating system on shared hardware. Analysts use them to read reports, run scripts on synthetic data and open documents in an environment that can be reset. Snapshots capture a known-good state to return to.
For Lena, the main value is being able to undo mistakes. If a document she opens from a partner turns out to be harmful, or a script behaves unexpectedly, she returns the machine to its snapshot and loses nothing that mattered. Her own work, such as notes and scripts, is kept in the team repository rather than only inside the VM.
6.3 Isolation limits
Virtual machines reduce risk but are not perfect barriers. Network settings matter: a machine with internet access can still contact adversary servers. CMS's analysis VM has no network route except to the internal update server.
Restricting the analysis VM to the internal update server means a document that tries to fetch something from the internet simply fails. That also stops Lena from accidentally visiting a link from a report, because there is no route to follow it. The single permitted route exists so the machine can still receive patches.
6.4 Suspicious files
Technologist-level analysts do not run malware. If a suspicious attachment arrives, Lena records its hash and metadata, submits it through CMS's approved sandbox service if policy allows, and leaves deeper analysis to qualified staff.
Recording the hash and metadata lets Lena check the file against MCX intelligence and the email gateway logs without opening it. The approved sandbox is used only where policy allows, because uploading a council document to an outside service may share information CMS has not agreed to share. Deeper analysis needs skills and safeguards a technologist post does not have.
6.5 Containers
Containers share the host kernel and isolate less than virtual machines. They suit packaging scripts, not handling hostile files.
A container is a convenient way to give colleagues Lena's matching scripts with the right Python version, because it starts quickly and behaves the same on each machine. Because it shares the host's kernel, a flaw that lets a process escape would reach the host directly, which is why hostile files stay inside the VM. Lena notes this difference in the team's handling guide, so nobody chooses a container for a task that needs the stronger isolation of a VM.
6.6 Patching the analysis environment
Analysis machines need updates too; an outdated VM is an easy target. Lena refreshes the base image monthly and re-creates her snapshot afterwards.
Re-creating the snapshot after each update matters, because otherwise every reset would return the VM to its unpatched state and undo the month's fixes. Lena records the date of each refresh, so she can tell whether a problem appeared before or after an update. A monthly refresh fits the rhythm of the patch releases Lena's tools receive. An outdated VM is especially risky for Lena, because the documents she opens there come from outside the council by design.
Worked example
An MCX report says attackers created a scheduled task named "CivicUpdate" on council servers. Lena asks the endpoint team to search for scheduled tasks with that name across CMS servers in the past 60 days. None appear. She records the query, period and data source, and notes that two servers lack endpoint agents — a coverage gap she reports.
Synthetic case. The task name and report are invented.
Errors and limits
A clean search covers only machines with logging; report gaps alongside results.
Exercises
- EX016 — Task technique. Which ATT&CK technique fits a malicious scheduled task? Rubric: 3 = Scheduled Task/Job T1053; 2 = name; 1 = T1190; 0 = none.
- EX017 — VM network. Why does CMS's analysis VM lack internet access? Rubric: 3 = prevents contact with adversary infrastructure/leaks; 2 = partial; 1 = speed; 0 = none.
- EX018 — Coverage gap. What gap did Lena report alongside her clean search? Rubric: 3 = two servers without endpoint agents; 2 = vague gap; 1 = minimal attempt; 0 = none.
Synthesis
Map OS behaviours to techniques, analyse in isolated, patched VMs, leave malware to qualified staff and report coverage gaps.
Continue studying — chapter 06 of 30
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →