Lab 11 — Build your analysis VM: FLARE-VM and safe file triage

Start with Lab 00 if VM creation is new to you. Get the x64 ISO from Microsoft's Windows 11 download page, or the evaluation page above. Create a new VM named flare-lab, attach the ISO and meet Windows 11's TPM, Secure Boot and other system requirements. Install the selected edition; do not use an unknown prebuilt analysis image.

Use a dedicated local administrator account such as analyst, with no spaces or special characters in its username. Do not add personal files, browser sync or work accounts. Initially use NAT only for updates and official tool downloads, without port forwarding.

In the VM's settings, set Shared Clipboard and Drag and Drop to Disabled, remove shared folders, and disconnect unnecessary USB devices. In VMware, use Options → Guest Isolation to disable copy/paste and drag/drop, and disable Shared Folders. Keep those choices throughout the lab; read commands in a guest browser while online or type them after disconnecting.

Update Windows fully, finish pending reboots and shut the guest down. In VirtualBox, select the VM, open Snapshots → Take, and name it clean-windows. In VMware, use VM → Snapshot → Take Snapshot. Then boot the guest.

Checkpoint: this snapshot is the Windows installation before analysis tools and reduced guest protections. Keep it separate from the ready-to-use snapshot you will create later.

Read the current FLARE-VM requirements and preparation instructions inside the guest. The project requires PowerShell 5 or later, internet access, at least 60 GB disk and 2 GB RAM, and disabled antimalware and Tamper Protection. Those FLARE minimums do not replace Windows 11's own requirements.

Inside this dedicated VM only: open Windows Security → Virus & threat protection → Manage settings and turn off Tamper Protection. Use the guest's Local Group Policy Editor, gpedit.msc, and follow FLARE's linked Defender preparation guidance for your Windows build. The usual policy is under Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus: enable Turn off Microsoft Defender Antivirus, apply, and reboot. Disable automatic Windows updates during installation as directed by FLARE; on Windows 11 Pro/Enterprise, the Configure Automatic Updates policy is under Windows Update's Manage end user experience folder.

The temporary real-time-protection toggle alone may turn back on. Policy behaviour also varies by Windows build. In Windows PowerShell, Run as administrator, inside the guest, inspect the actual state:

Get-Service WinDefend -ErrorAction SilentlyContinue | Select-Object Name, Status
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, IsTamperProtected
Get-ExecutionPolicy -List

Do not continue if Defender is still running, Tamper Protection remains enabled, or the installer later reports a failed requirement. Revisit the official preparation instructions for your build; do not bypass checks with -noChecks or alter host security to force installation. If the guest is managed or its settings are locked, use a fresh unmanaged lab guest.

Why this exception exists: analysis utilities can be quarantined during installation. It is a tradeoff confined to this disposable guest. Use its online phase for the official downloads only, then take it offline.

In the same guest Administrator Windows PowerShell, download the official installer to the guest Desktop and record its hash. Open the downloaded script in a text editor and review it before running the next box. The download follows the project's current main branch; package versions may change.

Set-Location ([Environment]::GetFolderPath('Desktop'))
Invoke-WebRequest -UseBasicParsing -Uri 'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1' -OutFile '.\install.ps1'
Get-FileHash .\install.ps1 -Algorithm SHA256 | Format-List | Out-File .\flare-installer-hash.txt

After review, allow the script in this guest and start it:

Set-Location ([Environment]::GetFolderPath('Desktop'))
Unblock-File .\install.ps1
Set-ExecutionPolicy -Scope LocalMachine Unrestricted -Force
.\install.ps1

Use the interactive installer and keep its validation checks. Review the package selection and terms. Supply the guest account password at the installer's prompt if needed for reboot recovery; do not put a password in a command or your notes. Allow the installer to reboot and resume. A changed wallpaper is not proof that every package succeeded.

If execution policy is overridden, inspect Get-ExecutionPolicy -List and the official README before changing another scope. For failed packages, read %VM_COMMON_DIR%\log.txt, chocolatey.log in %PROGRAMDATA%\chocolatey\logs, and boxstarter.log in %LOCALAPPDATA%\Boxstarter. Resolve the relevant download, dependency or version error before calling the build ready.

Checkpoint: the installation has finished its reboots, and you have checked the logs for failures. Keep the installer hash with your build notes; it identifies your download, but is not independent proof of trust.

Stay online for this step. In guest PowerShell, check the build tools:

git --version
rustc --version
cargo --version

If Git is missing, install Git for Windows from its official site. For Rust, use rustup and the MSVC toolchain. Windows builds also need Microsoft's C++ build tools with the Desktop development with C++ workload and a Windows SDK. Reopen PowerShell after installation. A missing link.exe usually means the C++ workload is absent. Do not assume Rust is included in FLARE-VM.

The following uses a new C:\Lab11\hacksguard checkout, pins the reviewed source revision, downloads its rule submodules and builds with the repository's lockfile. Run it in guest PowerShell. Stop on any reported failure:

New-Item -ItemType Directory -Force C:\Lab11 | Out-Null
Set-Location C:\Lab11
git clone https://github.com/Rhacknarok/hacksguard.git
if ($LASTEXITCODE -ne 0) { throw 'Clone failed; inspect the error.' }
Set-Location C:\Lab11\hacksguard
git checkout --detach 1acdaf60459b34251d3d47a47ed6b1b2eb978f17
if ($LASTEXITCODE -ne 0) { throw 'Checkout failed.' }
git submodule update --init --recursive
if ($LASTEXITCODE -ne 0) { throw 'Rule download failed.' }
cargo build --release --locked
if ($LASTEXITCODE -ne 0) { throw 'Build failed; resolve it before continuing.' }
.\target\release\hacksguard.exe --help
git rev-parse HEAD
git submodule status --recursive

Create a tiny lab-only YARA rule so the EICAR exercise has a known result. It recognises the test marker; it is not a general malware detector and is not an upstream vendor rule. Keep the rules folder alongside the checkout, and launch analysis from that directory.

Set-Location C:\Lab11\hacksguard
New-Item -ItemType Directory -Force .\rules | Out-Null
@'
rule StashGrid_Lab11_EICAR_Marker
{
    meta:
        description = "Harmless training marker; not a malware verdict"
    strings:
        $marker = "EICAR-STANDARD-ANTIVIRUS-TEST-FILE"
    condition:
        $marker
}
'@ | Set-Content -Encoding ASCII .\rules\stashgrid_lab11_eicar.yar
New-Item -ItemType Directory -Force C:\Lab11\samples, C:\Lab11\reports | Out-Null

Checkpoint: the build completed, --help works, and the source revision, rule submodules and lab rule are present. You are downloading and building the analysis tool here; you have not run a sample.

Save this walkthrough inside the guest if you want to copy its commands while offline. Shut the guest down. In VirtualBox, open Settings → Network and set every enabled adapter to Not attached. In VMware's Network Adapter settings, clear Connect at power on and ensure Connected is off for every adapter. Recheck sharing and passthrough settings from step 01.

Boot the guest and, in PowerShell, inspect the network state:

Get-NetAdapter | Select-Object Name, InterfaceDescription, Status
Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue
Get-NetRoute -DestinationPrefix '::/0' -ErrorAction SilentlyContinue

The virtual Ethernet adapter should be disconnected or disabled, with no usable default route. Unexpected active adapters or routes need investigating before triage. Check the hypervisor settings as well as Windows; a failed website or ping alone does not prove isolation.

Shut down again and take the snapshot flare-ready, then boot it for the exercise. This snapshot includes the compiled tool, rules and disconnected NIC settings. Recheck those settings after every restore.

Why not host-only? Oracle's networking documentation shows that host-only permits guest-to-host traffic. NAT also permits outbound access. This static exercise needs neither, so use a disconnected adapter. Real-malware handling requires a separate containment design; this lab does not authorize or validate it.

In guest PowerShell, use the guest's C:\Windows\System32\notepad.exe as a baseline. If that path is missing, choose an existing Windows executable from the same clean guest and record the substituted path. Hash it, record its actual signature status, then pass its path to hacksguard. Do not launch the file itself.

Set-Location C:\Lab11\hacksguard
$baseline = 'C:\Windows\System32\notepad.exe'
if (-not (Test-Path -LiteralPath $baseline)) { throw 'Baseline is missing; choose and document another Windows executable.' }
Get-FileHash -LiteralPath $baseline -Algorithm SHA256 | Format-List | Out-File C:\Lab11\reports\baseline-hash.txt
Get-AuthenticodeSignature -FilePath $baseline | Format-List Status, StatusMessage, SignerCertificate | Out-File C:\Lab11\reports\baseline-signature.txt
$result = & .\target\release\hacksguard.exe --json $baseline
if ($LASTEXITCODE -ne 0) { throw 'Analysis failed; do not treat an empty report as clean.' }
$result | Set-Content -Encoding UTF8 C:\Lab11\reports\baseline.json
$report = $result | ConvertFrom-Json
$report | Select-Object risk_score, risk_level, yara_matches
$report.basic | Select-Object sha256, entropy
Get-Content C:\Lab11\reports\baseline-signature.txt

For the interactive views, run the next command in the same PowerShell session, keeping your chosen baseline path. Use Tab to move through sections, imports and strings; q exits. The saved --json report is the comparison record: in the reviewed source revision, JSON mode runs YARA as part of analysis, while the interactive interface starts with YARA deferred.

Set-Location C:\Lab11\hacksguard
.\target\release\hacksguard.exe $baseline

Record what you actually see. A Windows utility may contain high-entropy sections or APIs the tool flags. Hacksguard decodes embedded certificate information; that is different from Windows checking an Authenticode signature. Get-AuthenticodeSignature can also use a catalog signature. An offline trust or revocation check may be incomplete. Neither a signature nor a low risk score proves a file is harmless.

Now create the standard harmless EICAR antivirus test text in the guest, without downloading malware or executing the test file. The two quoted pieces below join into the standard 68-byte text; ASCII output prevents a BOM or trailing newline. Antivirus products can deliberately alert on this text. If protection blocks it, record that outcome; do not weaken the host to obtain a result.

Set-Location C:\Lab11\hacksguard
$testText = 'X5O!P%@AP[4\PZX54(P^)7CC)7}' + '$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
[IO.File]::WriteAllText('C:\Lab11\samples\eicar.txt', $testText, [Text.Encoding]::ASCII)
Get-Item C:\Lab11\samples\eicar.txt | Select-Object Name, Length
Get-FileHash C:\Lab11\samples\eicar.txt -Algorithm SHA256 | Format-List | Out-File C:\Lab11\reports\eicar-hash.txt
$result = & .\target\release\hacksguard.exe --json C:\Lab11\samples\eicar.txt
if ($LASTEXITCODE -ne 0) { throw 'EICAR analysis failed; inspect the error.' }
$result | Set-Content -Encoding UTF8 C:\Lab11\reports\eicar.json
$report = $result | ConvertFrom-Json
$report | Select-Object risk_score, risk_level, yara_matches
$report.yara_matches -contains 'StashGrid_Lab11_EICAR_Marker'

The checks to satisfy: the text file's length is 68, and the final expression returns True. That means the local marker rule matched. Other rules may also match. This text is not a PE executable, so missing PE sections, imports and Authenticode fields are expected; record them as not applicable. There is no required risk score or requirement for it to exceed the Windows baseline.

If the marker is absent, check the working directory, the exact rule filename and its contents, and confirm you used --json. The reviewed source searches a local rules directory and does not surface every rule compilation error. A missing hit is a test failure to investigate, not evidence that the file is safe.

What this proves: the tool read two files and your selected rule recognised known text. You have not demonstrated malware execution, a real infection or comprehensive antivirus coverage. Risk scoring is a collection of heuristics, not a calibrated probability of maliciousness.

In the guest, write one short note per file under C:\Lab11\reports. Include:

• Identity: original path, source, byte size, SHA-256, date and Windows build.
• Tool context: hacksguard commit, rule submodule revisions and the local lab rule. State that the VM was disconnected.
• Observed facts: actual signature status, entropy, sections, notable imports or strings, reported score and exact rule names. Use “not applicable” for EICAR's PE-only fields.
• Interpretation: explain each finding in context. An API import describes a capability, not proof it was used. Packing and entropy alone do not establish intent.
• Verdict and limits: “Windows baseline from this guest” or “harmless EICAR fixture; local marker matched”, supported by your evidence. Static inspection did not establish runtime behaviour.

Before restoring, preserve the notes you want to keep: manually transcribe the short findings or capture the guest screen with the hypervisor. Keep host/guest sharing disabled and do not copy the EICAR fixture to the host. Reports left only on the guest disk will be rolled back. Create a disposable reset marker in guest PowerShell:

Set-Content -Encoding ASCII C:\Lab11\session-reset-marker.txt 'Created after flare-ready'

Shut down the VM and restore flare-ready from the hypervisor's snapshot view. Boot it, confirm all NICs remain disconnected, and run this inside the guest:

Test-Path C:\Lab11\session-reset-marker.txt
Test-Path C:\Lab11\samples\eicar.txt
Test-Path C:\Lab11\hacksguard\target\release\hacksguard.exe
Test-Path C:\Lab11\hacksguard\rules\stashgrid_lab11_eicar.yar

The expected sequence is False, False, True, True: the session changes disappeared, while the tool and rule survived. If they did not, check that you restored the correct snapshot and that its disk is included. Shut the guest down when finished.

For future sessions: begin from this verified snapshot. It still has the analysis guest's reduced protections, so do not reconnect it for general browsing. Do tool maintenance from a clean, sample-free state, then disconnect and create a new dated ready snapshot. Use clean-windows if you want to return to the pre-FLARE installation.