This content is open to everyone — sign in to save your progress, earn points, and unlock module exams.

Cloud Forensics and Incident Investigation

Topic 6.8 of Cloud Forensics and Incident Investigation

Malware Analysis & Sandboxing in Cloud

Cloud-based malware sandbox architecture, static and dynamic analysis of container images and Lambda packages, YARA rules for cloud-specific malware, and GuardDuty Malware Protection.

~30 min total·4 quadrants of structured content

By the end of this topic, you will

Design an isolated VPC-based malware analysis sandbox using EC2 and FakeNet-NG
Perform static analysis of a suspicious container image using Docker export and Trivy
Write a YARA rule targeting IMDS credential theft and crypto mining indicators
Identify five GuardDuty findings that indicate malware or C2 activity on EC2

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Quadrant 2 · e-Content

Articles and case studies

cloud-security

Malware Analysis & Sandboxing in Cloud Environments

Cloud infrastructure is both a target for malware and an ideal platform for malware analysis. This article covers cloud-hosted malware sandbox architectures, static and dynamic analysis of cloud-delivered malware, and detecting malware in container images and Lambda packages.

20 min read

Quadrant 3 · Web Resources