At BrightGoods Retail, an online retailer with 800 employees, a finance coordinator downloads an invoice from an email and her antivirus tool raises an alert. She has a deadline, and the file is sitting on her laptop. Someone has to decide quickly whether this is routine noise or the start of an incident.
That quick decision is called triage. It is a fast, structured look at a suspicious file that ends in a decision about what to do next, such as isolate the laptop, share indicators, or close the case. Triage does not need a full reverse-engineering effort. It needs an answer you can defend. Here is how the moment unfolds from download to decision:
The first mistake in most suspicious-file cases is made before any analysis begins. Someone double-clicks the file to see what happens. Safe handling prevents that.
Here is how those habits play out for the BrightGoods invoice case:
Original stays intactEvery claim you make later depends on evidence you can still point to. A modified original weakens all of it.
This course teaches one repeatable order. You look at the file without running it (static analysis), then watch it run in an isolated test environment called a sandbox (dynamic analysis). Next you collect indicators of compromise (IOCs), which are traces such as file hashes, domains, and IP addresses that help others spot the same threat. Then you map the behaviors to MITRE ATT&CK, a public catalog of attacker techniques. Finally you write a report. Each step has a checkpoint, shown here: