Three parts, one case study.
A cyber weapon is a system. You will take apart each disclosed component of Stuxnet-class malware and learn to recognize, analyze, and defend against it: the payload that did the damage, the delivery system that got it there unseen, and the command-and-control that kept its operators in charge of it.
Payload
Dissect how a documented payload attacked PLCs to disrupt their default operation, and how a second component ran a man-in-the-middle attack, spoofing the inputs coming from the PLC's I/O modules so its output did something other than the stock hard-coded logic said.
Trace how the payload replayed previously recorded input data, so the PLC logic and the human operator both believed all was well, and learn what telemetry would have exposed it.
Delivery System
Stealth. Analyze how a worm carried the main payload's routines, how it auto-executed its propagated copies, and how its rootkit component hid malicious files and processes from detection, and learn the forensic techniques that unwind each trick.
Precision. Study how the worm stayed dormant while it staked out the target, reactivating only when specific conditions were met, and the indicators that distinguish dormant reconnaissance from a false negative.
Command & Control
Study how the weapon phoned home, and how its fly-by-wire command-and-control let an operator flip a kill switch, track the worm's health, monitor its operations, and collect telemetry, so you can learn to fingerprint C2 traffic on the wire.
You will examine how the operators pushed live updates to the worm as they learned from its behaviour in hostile territory, and the network signatures that gave those updates away.
