🔑Scope check before you dive in: this activity covers exactly five malware types — virus, worm, trojan horse, backdoor, and spyware. Ransomware, rootkit, logic bomb, and keylogger are real AP vocabulary, but they belong to a later unit. If you see those terms elsewhere, they're not fair game for this activity yet.
4.1.BMalware
Five Malware Types to Know
Malware is malicious software built to damage or destroy a device or network, or to give an adversary access to a device and the data on it. It's rarely the adversary's end goal — it's the tool that gets them there. The five types in this lab differ mainly in how they get onto a device and what they do once they're there:
🦠 Malware Classifier — click each type
Needs a user to open or execute a file to activate. Once running, it can spread by attaching itself to other files or programs on the same device.
⚠️The virus/worm distinction trips people up constantly: a virus needs a human to open or run something. A worm needs nobody at all — it spreads on its own. If a scenario says "no one clicked anything and it still spread," that's a worm, not a virus.
4.3.B–CConcept
How Anti-Malware Software Actually Works
Anti-malware (or antivirus) software works by comparing files against a database of known signatures — detectable patterns unique to specific malware. It periodically scans a device's files, checks each one against that signature database, and quarantines or removes anything that matches.
file.exe→ check against signature database →match found → quarantine
The second major defense is simpler: keep software updated. When a vendor finds a vulnerability, they release a fix — often a small update called a patch. Staying current on patches closes the exact doors adversaries are trying to exploit.
💡Signature-based detection has a real limit worth knowing: it can only catch malware whose signature is already in the database. Brand-new malware, not yet catalogued anywhere, can slip past — which is exactly why patching and firewalls matter as a second and third layer of defense, not a replacement.
4.3.DConcept
Configuring a Host-Based Firewall
A host-based firewall runs on a single device and follows an ordered set of rules — an access control list (ACL) — deciding what traffic gets in or out. Rules apply in order: the first matching rule wins, so rule order matters as much as the rules themselves.
Firewall rules can filter by port, service, protocol, source, or destination. A device connected to a compromised network still gets an extra layer of protection from its own host-based firewall — it's not relying on the network's defenses alone.
🚦 Allow or Deny? — pick a traffic scenario
Inbound HTTPS (port 443) from any source
🔑The FTP-blocking example is worth memorizing as a pattern, not just a fact: a host-based firewall configured to block outbound FTP stops an adversary who's already gained remote access from using FTP to exfiltrate files. The lesson generalizes — block outbound traffic for services a device doesn't need, because an adversary can only exfiltrate through a door that's actually open.
4.4.AConcept
Reading Your First Firewall Log
A firewall log is simply the record of what the firewall allowed and denied. Every logged system — firewalls included — can be used to reconstruct what happened before and during an incident. Evidence that an adversary has compromised a device or network is called an indicator of compromise (IoC) — a term you'll see constantly for the rest of this course.
ExampleGuided Example — Reading a Firewall Log
A simplified firewall log shows three entries from the same afternoon:
14:02:11 10.0.0.15 → 93.184.216.34:443 ALLOW
14:02:45 10.0.0.15 → 45.33.12.9:21 DENY
14:03:02 10.0.0.15 → 8.8.8.8:53 ALLOW
Step 1 — Read the first entry
Port 443 is HTTPS — this is normal secure web traffic, and it's marked ALLOW. Nothing unusual here.