CS KAIROS · LEARNING LIBRARY
M07 · Malware Threats · Safe practice
This module uses offline data, self-created inputs or tabletop scenarios. Follow the steps and check the evidence you produce.
Offline exercise: three layers of an event note
Use the text record only. Do not download, execute or upload suspicious files.
- List the two directly observed events.
- Propose one benign and one malicious explanation.
- Name two follow-up evidence items that distinguish them and a reporting contact role.
Expected result
Both hypotheses remain open; package provenance and actual changes can improve the judgment.
Check your work
Did your note accidentally turn suspicious into confirmed compromise?
Finish and clean up
Keep the text analysis. There are no malware samples or system changes.