Identify the malware analysis technique in which the investigators must take a snapshot of the baseline state of the forensic workstation before…

Monitoring host integrity is a fundamental technique in dynamic malware analysis. It involves establishing a known-good baseline of a system by taking a snapshot of its state, including the file system, registry, running processes, and network connections. The suspected malware is then executed within this controlled environment. Afterward, a second snapshot is taken. By comparing the "before" and "after" snapshots, an analyst can precisely identify the changes and modifications made by the malware, revealing its behavior and impact on the host system.

A. Online malware scanning: This technique involves uploading a suspicious file to a web service (e.g., VirusTotal) for analysis by multiple antivirus engines, not creating a local system baseline.

C. String search: This is a static analysis technique used to find embedded, human-readable text like IP addresses or commands within the malware's code without executing it.

D. File fingerprinting: This process generates a unique hash value (e.g., MD5, SHA-256) for a file to identify it, but it does not involve taking a snapshot of the entire system state.

1. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press.

Chapter 1, Section: "Dynamic Analysis," pp. 12-13: The text explicitly describes dynamic analysis as involving the execution of malware and observing its behavior. It highlights the importance of using tools that monitor system changes, which is achieved by comparing the system state before and after execution. This process is the core of host integrity monitoring.

2. Zeltser, L. (2010). Automated Dynamic Malware Analysis. SANS Institute InfoSec Reading Room.

Section: "How Automated Dynamic Malware Analysis Tools Work," p. 3: "The tool takes a snapshot of the system’s state before running the specimen. After the program terminates... the tool takes another snapshot. The tool then compares the 'before' and 'after' snapshots to identify changes that the specimen made to the file system and the registry." This directly describes the process of monitoring host integrity via baselining.

3. NIST Special Publication 800-83 Rev. 1. (2013). Guide to Malware Incident Prevention and Handling for Desktops and Laptops. National Institute of Standards and Technology.

Section 3.3.2, "Analyzing Malware in a Lab," p. 23: This section discusses the use of sandboxes for malware analysis, which often "revert to a clean baseline state after each use." This principle of using a baseline state is central to the technique of monitoring host integrity to detect malware-induced changes.