TrainSec Tiny Masterclass

Malware Analysis to Detection Engineering

A Hands-On 4H Masterclass

Most malware analysis ends with a report. Most detection rules are written without ever seeing the malware they are meant to catch. This live masterclass closes that gap.

In Malware Analysis to Detection Engineering, Uriel Kosayev, co-founder of TrainSec and author of Antivirus Bypass Techniques and Malware Analysis on Steroids, takes a Windows malware investigation from the first triage step all the way to a detection rule that has been tuned, validated, and tested against bypass attempts. You do the work yourself, in your own Flare-VM lab and your own Elastic Security environment.

Along the way you will watch a detection miss a small change in attacker behavior, find out why, and fix it. That is the loop real detection engineering runs on:

ATTACK → TELEMETRY → INVESTIGATION → DETECTION → TUNING → VALIDATION → BYPASS → BETTER DETECTION.

Four hours, live on Google Meet, with the recording available afterwards in the TrainSec student portal. You leave with practical, hands-on experience and the detection rules you built during the session.

Part of Tiny Masterclasses by TrainSec, a series of short, live, hands-on masterclasses with a new event every month. See what’s coming next at trainsec.net/events.

What we will cover in this masterclass?

Analysis workflow and lab foundations Define the investigation question, confirm your lab is safe and isolated, and learn when to use static analysis, dynamic analysis, and telemetry-based investigation.
Malware triage and static analysis File type, hashes, executable metadata, strings, imports, and signs of packing or obfuscation. Turn first findings into testable hypotheses, and understand the limits of file reputation and isolated indicators.
Dynamic analysis and behavioral investigation Run the sample in an isolated Windows lab and follow what it actually does: process trees, command lines, file and registry changes, persistence, and network activity.
From behavior to useful telemetry Map each observed action to Windows Event Logs and EDR telemetry. Identify the fields that matter, correlate activity across processes and time, and tell a missing detection apart from missing data.
Detection engineering and tuning Turn the investigation into behavior-focused detection logic. Write Elastic Security KQL queries, understand the data each one needs, separate a search query from a configured detection rule, and tune it against benign activity.
Validation and bypass testing Replay the behavior and check that your detection fires. Change filenames and execution context, watch the coverage break, find out why, and improve the rule. Re-test malicious and benign cases before calling it done.

Discussion and Q&A The full investigation-to-detection workflow end to end, common analysis mistakes, and how to apply the method in your own authorized environment.

Why this masterclass is different?

One investigation, start to finish. Most training teaches malware analysis and detection engineering as separate skills. Here they are one continuous workflow, following a single investigation from the first triage step to a validated rule.
You build it yourself. This is not a slide deck or a demo to watch. You work in your own Flare-VM lab and your own Elastic Security environment, and the detection rules you write stay with you.
We break the detection on purpose. Writing a rule that fires once is easy. You will test controlled bypasses, see exactly where coverage fails, and improve the rule. That step is usually left out.
Taught from the attacker’s side. Uriel wrote the book on antivirus bypass. He knows how attackers slip past detections, and he teaches defenders to write rules with that in mind.
Four focused hours. No multi-day commitment. One live session that covers the full loop, with a recording you can come back to.
Effectively free credit. Your $59 seat comes with a $59 voucher you can use on any TrainSec course.

Who is this for?

SOC analysts who want to go beyond triaging alerts and understand how the detections behind them are built.
Detection engineers who want their rules grounded in real malware behavior, not just indicators.
Blue team and purple team practitioners who need to prove their detections hold up against attacker variations.
Incident responders and threat hunters who want to turn what they find during an investigation into lasting detection coverage.
Malware analysts who want their findings to end in working detection logic, not only a report.

Trusted by 10K+ students and companies

Save my spot:

$59

Bonus: Each student gets $59 voucher for our catalog.

Looking for team purchase? Contact us now!

By the end of this session you will:

Apply a repeatable malware triage and behavioral investigation workflow.
Map observed malware behavior to the Windows Event Log and EDR telemetry fields needed to detect it.
Tell the difference between a missing detection and missing data, and know which one you are facing.
Write behavior-focused detection logic in Elastic Security using KQL, including its data requirements and likely false positives.
Tune a detection against benign activity and document its assumptions, exclusions, and coverage limits.
Validate a detection, recognize coverage gaps, and use controlled bypass testing to make it stronger.

Pre-requisites:

An understanding of Windows processes, files, the registry, basic networking, and security logs.
Familiarity with command-line tools. Experience with a SIEM or EDR console is helpful.
No advanced reverse engineering experience required. Foundational concepts are explained as they come up.
A malware analysis VM: an isolated Windows virtual machine with Flare-VM installed, with a clean snapshot taken before the session. Never run workshop samples on your host computer.
An Elastic Security account: register for the Elastic Security free trial. Free trials are time-limited, so sign up a few days before the masterclass so your account is active on the day.
A laptop or desktop with a stable internet connection and working audio.

Uriel Kosayev

Malware researcher, reverse engineer, and TrainSec co-founder with over a decade in the field.

@UrielKosayev

Uriel Kosayev is a cybersecurity researcher and reverse engineer with over a decade of experience in malware analysis, offensive security, and incident response. He co-founded TrainSec Academy and authored two books: Antivirus Bypass Techniques (8,000+ copies sold) and MAoS: Malware Analysis on Steroids (2025).

His expertise spans malware analysis and reverse engineering, red team operations, antivirus bypass techniques, incident response, and defensive strategy. He has published academic white papers on malware detection and memory-based threats, and contributed vulnerability research to the MITRE ATT&CK framework.

His teaching is built on one idea: think like an attacker, act like a defender. At TrainSec he develops and teaches advanced courses in malware analysis, offensive security, and practical defense, including Malware Analyst Professional and Detection Engineering Professional: Attack Simulation & Defense.