Study how malicious software works using inert specimens, simulations and controlled analysis.
loaders, persistence, payloads and command channels
inspect files without executing them
observe behavior inside an isolated sandbox
identify suspicious files with detection rules
containment, detection and cleanup