Inspect files and messages with controlled tools
Strings can reveal readable fragments inside a file, but absent strings do not prove that a capability is absent. YARA matches defined patterns and conditions; a match identifies those conditions, not automatically a malware family. VirusTotal and other multi-source services can provide reputation and analysis context, but uploading an artifact can disclose its contents. Follow handling policy before any submission.
A sandbox such as Joe Sandbox or Cuckoo Sandbox observes behaviour in a controlled execution environment. A quiet run may reflect missing dependencies, timing, or environment checks rather than safety. Prefer approved isolated workflows, record the sample identity and analysis settings, and distinguish observed behaviour from hypothetical capability. Do not execute an unknown file on the analyst workstation.
Decode data while retaining its structure
CyberChef can apply recorded transformations such as Base64 decoding or URL decoding. Encoding is representation, not encryption or proof of malice. Save the original, record the transformation sequence, and inspect the result as data. A decoded script remains untrusted text; understanding it does not require running it or contacting destinations it contains.
Recognise the structure of the evidence before searching it. JSON represents objects and arrays; XML uses elements and attributes; YAML relies on its syntax, including indentation, to express structured values. EVTX is a Windows event-log format that needs an appropriate reader or export. Preserve native evidence alongside exported views because text conversion can discard metadata or change representation.
Make small scripts explainable and reversible
Python, PowerShell, and shell scripts can reduce repetitive evidence handling. Review inputs, outputs, permissions, and side effects before using one. A read-only transformation of a copied log is easier to validate than a script that both queries production systems and changes them. Test on a small synthetic sample with known expected results and keep the original evidence unchanged.
Regular expressions identify text patterns; they do not replace a parser when field structure matters. Count matches, non-matches, and malformed records so a convenient query does not hide exclusions. When interpreting a suspicious command, identify the executable, arguments, inputs, outputs, and surrounding process context. Describe intended behaviour separately from evidence that it completed successfully.