Lesson 27 — Malware Analysis Assistance
Security Copilot can help analysts understand suspicious files, scripts, commands, process trees, behaviours and indicators inside Microsoft Defender.
Copilot file analysis and script analysis can accelerate triage, while Defender file pages, deep analysis, device timelines and threat intelligence provide the evidence needed to validate the result.
This lesson explains how to use AI-assisted malware analysis without treating a generated summary, hash match or sandbox result as the final verdict.
What you will learn
This lesson develops an evidence-first suspicious-file and script-analysis workflow.
Malware-analysis assistance workflow
↓
Capture hashes, path, source, user and device context
↓
Review Defender file page, alert evidence and process tree
↓
Use Security Copilot file or script analysis
↓
Inspect static properties and decoded content
↓
Review observed endpoint behaviour
↓
Submit supported files for deep analysis when justified
↓
Compare sandbox findings with internal device evidence
↓
Enrich indicators and assess prevalence
↓
Consider legitimate explanations and analysis limitations
↓
Approve containment, submission or specialist escalation
Malware-analysis evidence domains
| Domain | Evidence | Analyst question |
|---|---|---|
| Artefact identity | Hashes, filename, path, size, signature and source. | What exact sample is being investigated? |
| Execution context | User, device, parent process, command line and integrity. | How and where did it run? |
| Behaviour | Processes, files, registry, services, tasks and network activity. | What did the artefact actually do? |
| Intelligence | Reputation, family, campaigns, infrastructure and prevalence. | What external and internal context exists? |
| Validation | Source rows, sandbox results, alternatives and limitations. | How reliable is the assessment? |
| Response | Quarantine, isolation, blocking, submission and escalation. | What action is justified? |
Learning objectives
- Use Copilot file and script analysis.
- Review file identity and prevalence.
- Analyse processes, files, registry and network behaviour.
- Interpret deep-analysis and sandbox results.
- Extract and validate indicators.
- Handle false-positive and false-negative submissions.
- Make evidence-based response and escalation decisions.
What is malware-analysis assistance?
Malware-analysis assistance uses Security Copilot and Defender evidence to explain suspicious files, scripts, commands and behaviours while preserving analyst judgement.
Assistance is not reverse engineering
Copilot summaries do not replace specialist static analysis, dynamic analysis, memory forensics or reverse engineering.
Start with the original artefact
Preserve the exact file, script, command, hash, path, source and collection time.
Maintain evidence integrity
Use approved evidence-handling procedures and avoid changing the artefact before analysis.
Record hash values
Capture SHA256 and available supporting hashes to identify the exact sample.
Hash is identity, not behaviour
A hash identifies a file version but does not explain what occurred on the device.
File name is weak evidence
Malware can use legitimate names and legitimate files can use suspicious names.
File path adds context
Execution from temporary, download, user-profile or system directories can change the assessment.
Digital signature context
Review publisher, signing status, certificate validity and whether the signature matches the file.
A valid signature is not a verdict
Signed software can be vulnerable, stolen, abused or distributed through compromised channels.
File prevalence
Internal prevalence helps distinguish rare files from widely deployed software.
Global prevalence
External prevalence can provide context but should not override internal evidence.
First seen and last seen
Timing helps connect the artefact to the incident and distinguish old software from new activity.
Source of the file
Determine whether the file came from email, browser download, software deployment, removable media or another process.
Mark of the Web
Internet-origin metadata can support delivery analysis where available.
File entity page
The Defender file page provides hashes, prevalence, alerts, observed devices, names, paths and related evidence.
File analysis with Copilot
Copilot in Defender can summarise suspicious-file evidence and help analysts identify relevant behaviours and indicators.
Review the source data
Open the file page, device timeline, process tree and related alert evidence behind the summary.
Static analysis
Static analysis examines file properties, strings, imports, sections, metadata and code structure without execution.
Dynamic analysis
Dynamic analysis observes what the artefact does when executed in a controlled environment.
Deep analysis
Defender for Endpoint can submit supported files to Microsoft’s secure cloud sandbox for deeper behavioural analysis.
Sandbox report
Review created processes, files, registry changes, network activity, detections and execution outcomes.
Sandbox limitations
The sample might detect analysis, require unavailable input or fail to exercise hidden behaviour.
Execution conditions
Malware can depend on user interaction, credentials, network access, time, locale or specific applications.
Packed files
Packing and compression can hide strings and code until execution.
Obfuscation
Encoded or transformed content may delay analysis but is not automatically malicious.
Script analysis with Copilot
Security Copilot can analyse PowerShell and supported command-line scripts in Defender and the standalone experience.
Suspicious script promptbook
The suspicious-script analysis promptbook helps analysts examine PowerShell or Windows command-line content.
Preserve the complete script
Partial commands can omit functions, variables, downloads or execution flow needed for accurate interpretation.
Decode safely
Decode Base64 and other representations without executing the content.
Explain each stage
Separate variable setup, deobfuscation, download, execution, persistence and cleanup.
PowerShell context
PowerShell is widely used for administration and should be assessed using user, parent process, command and network evidence.
Command-line interpretation
Quoting, escaping, environment variables and redirection can materially change command behaviour.
Parent process
The initiating process can reveal whether execution came from Office, a browser, management software or an attacker-controlled process.
Child processes
Processes launched by the sample can reveal execution, discovery, persistence or payload staging.
Process tree
Review the complete ancestry and descendant chain rather than only the detected process.
Process integrity
Token level, account, session and elevation context help explain impact.
File creation
Review payloads, scripts, archives, configuration files and temporary artefacts created by the sample.
File modification
Changes to existing files can reveal tampering, replacement or infection.
Registry activity
Registry changes can indicate persistence, configuration modification or ordinary installer behaviour.
Services and drivers
New services or drivers require publisher, path, start type and installation-context review.
Scheduled tasks
Review task action, trigger, author, user context, creation method and timing.
Startup mechanisms
Review startup folders, Run keys, services, WMI subscriptions and login scripts where relevant.
Defense changes
Review exclusions, disabled controls, altered policies and tampering evidence.
Network activity
Connect destinations with the process that owned the connection.
DNS activity
Review domains, resolutions, timing and related processes.
HTTP and TLS context
Review URLs, hosts, certificates, methods, user agents and transferred content where available.
Beaconing
Repeated intervals can suggest command-and-control but require enough events and timing validation.
Downloads
Confirm source URL, destination path, initiating process, hash and execution.
Uploads
Outbound transfer volume does not prove exfiltration without destination and data context.
Credential access
Look for LSASS access, browser credential files, token theft and authentication artefacts.
Discovery behaviour
System, account, network and security-product discovery can support the behavioural assessment.
Lateral movement
Review remote services, logons, credential reuse and movement to other devices.
Collection
Review archive creation, staging paths, bulk access and mailbox or cloud downloads.
Impact behaviour
Encryption, deletion, service disruption and recovery inhibition require direct supporting evidence.
Indicators extracted
Collect hashes, domains, URLs, IPs, mutexes, paths, certificates and registry locations.
Indicator freshness
Validate current ownership, reputation and internal relevance before blocking.
Threat-intelligence context
Use Microsoft Threat Intelligence to compare malware families, campaigns, infrastructure and actor assessments.
Family labels can differ
Security vendors can use different names or classifications for the same sample or behaviour.
Attribution requires more
A malware-family match does not prove the identity of the operator.
MITRE ATT&CK mapping
Map confirmed behaviours to techniques while preserving the distinction between mechanism and malicious intent.
Security Copilot summary
Ask Copilot to separate file properties, observed behaviour, intelligence context and analyst inference.
Ask for uncertainty
Require Copilot to identify behaviours that were not observed or could not be tested.
Ask for legitimate explanations
Request installer, administration, penetration-testing and software-update alternatives.
Ask for missing evidence
Identify unavailable files, incomplete scripts, unhealthy sensors, sandbox failures and retention gaps.
Ask for internal prevalence
Request devices, users, paths, first seen, last seen and deployment source.
Ask for related evidence
Request alerts, incidents, process trees, messages, downloads and network sightings.
Ask for next pivots
Request the highest-value file, process, user, device, domain and identity pivots.
Submit files to Microsoft
Files or hashes can be submitted from the Defender portal for Microsoft review when detections appear incorrect or missing.
False positive submissions
Submit a suspected false detection with accurate context rather than immediately allowing the file.
False negative submissions
Submit suspicious undetected artefacts for Microsoft analysis where policy permits.
Containment decisions
Isolation, quarantine, blocking and indicator actions should reflect confirmed evidence and business impact.
Quarantine context
Confirm which file was quarantined, on which devices and whether execution occurred first.
Block indicators carefully
File, certificate, URL and IP blocks can affect legitimate business services.
Live response
Approved responders can use live response for investigation and remediation within governed procedures.
Do not execute samples casually
Suspicious artefacts should not be opened or run on normal analyst workstations.
Use isolated analysis environments
Dynamic analysis belongs in approved sandboxes and forensic environments.
Protect sensitive samples
Malware samples can contain credentials, customer data, proprietary code or regulated information.
Document the analysis
Record artefact identity, evidence, methods, findings, limitations, confidence and response decisions.
Peer review
High-impact malware findings should be reviewed by another analyst or specialist.
Escalate to specialists
Complex packers, kernel malware, memory-only payloads and advanced evasion may require reverse-engineering expertise.
Final analyst judgement
Security Copilot accelerates understanding, but the analyst decides whether the artefact is malicious, relevant and actionable.
Example malware-analysis prompt
Include:
1. File names, paths, size, signature and first-seen information
2. Internal prevalence and affected devices
3. Parent and child processes
4. Command lines and execution user
5. Files, registry keys, services and scheduled tasks created or modified
6. Network destinations, URLs, DNS requests and certificates
7. Deep-analysis or sandbox behaviours
8. Extracted indicators and current threat-intelligence context
9. Legitimate software, installer and administration alternatives
10. Confirmed, probable, possible and unsupported findings
State analysis limitations and do not classify the file as malicious based only on reputation or a family label.
Agent Foskett investigation: “The malware never ran…”
↓
Security Copilot summarised the file as credential-stealing malware
↓
The incident draft stated that the endpoint was compromised
↓
Agent Foskett checked the email evidence
↓
The message had been delivered
↓
The attachment had not been opened
↓
No matching hash existed on any device
↓
No process, file, registry or network activity appeared
↓
Deep analysis showed malicious behaviour in the cloud sandbox
↓
The file was genuinely malicious
↓
The user and endpoint were not compromised by it
↓
The message was removed and the sender infrastructure blocked
↓
The affected mailbox was monitored for related messages
↓
The malware verdict described the file
↓
It did not describe what happened inside the organisation
Malware-analysis validation checklist
| Area | Question | Validation action |
|---|---|---|
| Identity | Is this the exact file or script? | Confirm SHA256, size, path and source. |
| Execution | Did the artefact actually run internally? | Review process, device and message evidence. |
| Behaviour | Which actions were directly observed? | Inspect raw endpoint and sandbox events. |
| Prevalence | How many devices and users observed it? | Review first seen, last seen and deployment source. |
| Signature | Is the publisher and signature valid and relevant? | Verify signer and certificate context. |
| Sandbox | Did deep analysis exercise the expected behaviour? | Review execution conditions and limitations. |
| Intelligence | Are family and campaign labels current? | Check source, date and confidence. |
| Alternatives | Could legitimate software explain the evidence? | Check management, installation and business context. |
| Response | Is isolation, blocking or quarantine justified? | Assess internal execution and business impact. |
| Escalation | Does the artefact require specialist analysis? | Record packers, evasion, memory or kernel concerns. |
Key takeaways
- Security Copilot provides file-analysis and script-analysis assistance in Microsoft Defender.
- The suspicious-script analysis promptbook can examine PowerShell and Windows command-line scripts.
- Defender file pages provide hashes, prevalence, observed devices, paths, alerts and related evidence.
- Supported files can be submitted for deep analysis in Microsoft’s secure cloud sandbox.
- Sandbox behaviour must be compared with what actually occurred inside the organisation.
- A malicious file can be delivered or quarantined without successfully executing.
- Hashes, family labels and ATT&CK mappings do not prove impact or attribution.
- Files or hashes can be submitted to Microsoft for false-positive or false-negative review.
- Complex artefacts may require digital-forensics or reverse-engineering specialists.
- The final malware and compromise assessment remains a human analyst decision.
What Agent Foskett checked
- Message delivery
- Attachment open
- SHA256 sightings
- Device file events
- Process execution
- Registry activity
- Network connections
- Deep analysis
- Mailbox remediation
- Final compromise scope
Best practices
- Preserve the artefact.
- Confirm the exact hash.
- Check execution context.
- Review raw behaviour.
- Compare sandbox and endpoint.
- Validate prevalence.
- Consider legitimate alternatives.
- Submit disputed detections.
- Escalate complex samples.
- Keep judgement human.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How does Microsoft Security Copilot assist malware analysis?
Security Copilot in Microsoft Defender can analyse suspicious files and scripts, summarise behaviours and help analysts identify indicators, ATT&CK mappings and investigation pivots.
Microsoft Defender deep file analysis
Defender for Endpoint can submit supported files to Microsoft’s secure cloud sandbox for deep analysis and return a detailed behavioural report.
Validate AI-assisted malware findings
Analysts should compare file reputation, sandbox behaviour, internal prevalence, process trees, device events and delivery evidence before deciding whether malware executed or caused compromise.
