Episode 55 — Spot Malicious Code Behaviors: Infection, Persistence, Evasion, and Lateral Movement

This episode teaches you to recognize malicious code by behavior patterns rather than relying on labels, which aligns with GSEC questions that describe symptoms and ask what is happening or what control best interrupts it. You’ll define infection as the initial execution path, persistence as mechanisms that survive reboots, evasion as attempts to avoid detection, and lateral movement as expansion to new systems using credentials, remote services, or trusted tools. We’ll use scenarios like a phishing attachment launching a script, a scheduled task reappearing after removal, security tools being disabled before payload execution, and new admin logons across multiple hosts shortly after a workstation compromise. Best practices focus on reducing execution paths, hardening administrative tools, monitoring high-signal events like new autoruns and unusual service creation, and isolating systems quickly when behavior indicates propagation. Troubleshooting considerations include distinguishing misconfiguration from malware, verifying whether artifacts are legitimate enterprise tooling, and preserving evidence while containing spread, since cleanup without understanding persistence often leads to reinfection. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.