Home labs & practical projects

Write a static triage report for a benign training binary

A project to do with your own tools, with guidance on what to create and capture.

Local lab Suggested time: 2–3 hoursYour own authorised environment

What you could create

An analyst must assess an unfamiliar educational binary before deciding whether further analysis is justified. The exercise focuses on evidence and safe handling.

Example evidence format

Project evidence map (example)

Static triage worksheetScope and inputs

Behaviour hypotheses and follow-up planDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Static triage worksheet	Show the inputs, scope and decisions behind this record. A suspicious string alone is not reported as proof of malicious behaviour.
Behaviour hypotheses and follow-up plan	Include the evidence supporting your conclusion. Hashes and tool versions let another analyst identify the same sample and method.

What you'll need

Local lab

Use a benign program you compiled or a clearly documented educational sample. Work in a disposable offline VM; live malware is not required.

Project record

Keep the working files for static triage worksheet and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.

Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.

Suggested milestones

1
Plan and investigate
Record file identity, metadata, readable strings and imported capabilities.
2
Develop your approach
Distinguish observable structure from hypotheses about runtime behaviour.
3
Verify and explain
Recommend the next analysis steps and explain what each would establish.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Static triage worksheet
Show the inputs, scope and decisions behind this record. A suspicious string alone is not reported as proof of malicious behaviour.
2
Behaviour hypotheses and follow-up plan
Include the evidence supporting your conclusion. Hashes and tool versions let another analyst identify the same sample and method.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your static triage worksheet needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Use a benign program you compiled or a clearly documented educational sample. Work in a disposable offline VM; live malware is not required.

What a good result looks like

A suspicious string alone is not reported as proof of malicious behaviour.
Hashes and tool versions let another analyst identify the same sample and method.

Finish the project

Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.