Research / Defensive engineering
Malware research you can inspect, test and challenge.
Two interactive, harmless research demonstrations: a synthetic detection benchmark and a mobile manifest security review. The source code and tests are published. These are teaching and methodology artifacts, not evidence of customer malware incidents or a staffed analysis laboratory.
Research methodology
Reproducible outcomes, not dramatic screenshots.
Each simulated observation is labeled, the matching rule is visible, and the result can be independently recalculated. This makes false positives and blind spots explicit.
- 01
APK intake
- 02
Manifest + DEX
- 03
Isolated runtime
- 04
Correlate signals
- 05
Report / IOCs
Review what an app declares, compare it with controlled behavior, and separate observations from assumptions.
Research-method illustration; the interactive lab uses harmless synthetic data, not live malware.
01 / Define the boundary
Use fabricated endpoint events and mobile app declarations. No real customer, malware or restricted defense data is collected.
02 / Make rules inspectable
Publish matching logic, event labels and observations. Test the same pure functions that power the browser.
03 / Count misses and false alarms
Display true and false positives and negatives. A detection that looks compelling on a screenshot can still miss cases.
04 / Document limitations
Distinguish a synthetic learning exercise from production detection coverage, reverse engineering or an external evaluation.
Lab 01 / Deterministic detection benchmark
Test rule coverage against eight fictional events.
No executable malware, incoming uploads, network traffic or real incident data. Toggle detection rules to see which synthetic threats are found, missed or incorrectly flagged. Results recalculate entirely in your browser.
True positives
3
False positives
1
False negatives
1
True negatives
3
Precision
75%
Recall
75%
| Scenario | Ground truth | Detected | Outcome |
|---|---|---|---|
| EV-01 · Suspicious encoded shellEncoded invocation in a fabricated incident timeline. | Threat simulation | encoded-shell | True positive |
| EV-02 · Legitimate admin scriptDeliberate false positive: encoded commands are not inherently malicious. | Benign | encoded-shell | False positive |
| EV-03 · Autostart persistenceSimulated run-key entry points to a temporary path. | Threat simulation | temp-autostart | True positive |
| EV-04 · Approved updaterAn established installation path does not match the lab rule. | Benign | No alert | True negative |
| EV-05 · Fictional command channelFictional indicator reserved for demonstration, not a real threat feed. | Threat simulation | known-synthetic-indicator | True positive |
| EV-06 · Normal diagnostic telemetryBenign synthetic telemetry does not match the indicator. | Benign | No alert | True negative |
| EV-07 · Missed simulated persistenceIntentional false negative: the simple rules miss a simulated threat outside the temporary path. | Threat simulation | No alert | False negative |
| EV-08 · Normal text editorNo monitored suspicious behavior observed. | Benign | No alert | True negative |
These metrics are calculated on a tiny fabricated dataset. They are NOT production detection rates, malware-vendor benchmarks or third-party evaluation results.
Lab 02 / Mobile manifest risk review
Inspect synthetic Android permission and component risks.
Select a harmless, fictional app profile. This is static manifest-pattern analysis, not an actual APK scanner, malware verdict, device scan or iOS exploit demonstration.
Intentionally over-permissioned test manifest. This is NOT evidence that an app is malware.
Manifest declarations
- android.permission.INTERNET
- android.permission.READ_SMS
- android.permission.RECEIVE_BOOT_COMPLETED
- receiver.exported: true
- application.allowBackup: true
Review observations (4)
- SMS permission: validate user need, consent and data handling.
- Exported receiver: inspect access controls and caller validation.
- App backup permitted: review sensitive-data exclusion and device backup policy.
- Boot receiver: investigate persistence purpose and actual runtime behavior.
Permissions and exported components require context. Findings identify review questions, not malicious intent. Real Android/iOS work requires signed scope, isolated test devices and approved evidence handling.
Published technical case studies
See how observations become a reviewable engineering handoff.
Two investigations using sample data cover detection gaps, Android permissions and next-test criteria.
Read synthetic case studies and findingsReal tooling / Harmless samples
Validated YARA matching and Sigma syntax, with reproducible evidence.
On November 7, 2026 UTC, we tested YARA 4.5.8 against two benign text fixtures on Apple Silicon macOS and checked a test-status Sigma rule using the installed CLI.
YARA engine verification
The named lab marker matched one harmless positive file and produced zero matches for a harmless negative file. SHA-256 hashes, version, rule and exact test harness are committed with the evidence.
Review captured validation reportSigma parser and operating limits
The installed Sigma CLI reported no rule or condition errors for a synthetic process-creation rule. No SIEM conversion, backend execution, actual malware, isolated detonation, incident artifact or government-controlled data was tested.
View benign fixtures and test instructionsIndependent verification
Run the same logic against the same fixtures.
The TypeScript source drives both demonstrations and is covered by deterministic unit tests. No external scanners, threat feeds or unsupported dataset claims are involved.
Source and tests
Review the rule definitions, synthetic event data, fixture selection and unit assertions directly.
pnpm test -- lib/defense/synthetic-threat-lab.test.ts
Interpretation boundary
The local fixtures exercise a narrow detection rule. A wider investigation adds real telemetry, controlled collection, tuning and validation against the target environment.
Explore security assuranceFor program and enterprise buyers
From evaluation to a scoped engagement.
The published labs demonstrate reasoning and test approach. Actual engagements require a confirmed team, authorized evidence source, isolated facilities when applicable and a contract-specific handling plan.