DF2: Lesson 2 How Malware Spreads – and How Systems Fight Back

Can you trace how one disguised file triggered a system-wide malware spread?

This KS3 / lower secondary computing lesson explores drops students into an (offline) command-line simulation to trace how a disguised malware file spreads through a fictional network.

Using realistic terminal commands, students uncover how actions like renaming or forwarding a file can trigger a breach. They cross-check user logs with forensic trace files, identify inconsistencies in digital evidence, and determine who was responsible.

Alongside the investigation, students explore how antivirus software, firewalls, and system rules help prevent threats. A fully guided structure supports their reasoning, with an optional extension on metadata tampering.

The lesson builds real analytical confidence while showing how cyber forensics is used to trace, question, and protect.

Through this, students uncover:

• How to classify system behaviour using a structured log investigation tool
• Why timing, access roles, and sequence patterns matter in threat detection
• How to use a risk scoring system to prioritise suspicious actions
• What makes an entry a potential breach, cover-up, or access point

Files download instantly.