Does finding malware prove it was executed?¶
Finding malware on a device does not automatically prove that it executed.
Avoid the dangerous assumption¶
The dangerous assumption is that presence and execution are the same thing.
They are not.
A malicious file may have been:
- downloaded but never opened
- attached to a message but never extracted
- blocked by security software
- quarantined before execution
- copied onto the device during examination
- partially written
- stored in a backup
- left behind from an earlier incident.
Investigators should look for execution evidence.
That may include:
- process-creation records
- parent and child processes
- command-line activity
- memory artefacts
- prefetch or execution traces
- registry or startup changes
- scheduled tasks
- network connections
- security-tool telemetry
- file-access and user activity
- subsequent payloads.
The exact artefacts depend on the operating system, application and time elapsed.
A security product may report “malware detected” even where the product prevented execution. Read the action field carefully. Terms such as blocked, quarantined, remediated, observed and executed have different meanings.
Do not rely only on file timestamps. They can reflect download, copy, extraction, modification or system behaviour rather than execution.
Where specialist analysis identifies code capability, keep that separate from evidence of use. A sample may be capable of stealing credentials without evidence that credentials were stolen in this case.
Likewise, execution does not prove every function ran successfully.
The file may have crashed, been interrupted or lacked required permissions.
Also identify whether later system changes, user activity or remediation may have removed execution artefacts. A lack of surviving evidence may limit the conclusion without proving that execution did not occur.
Operational takeaway¶
Require process, memory, system or network evidence of execution rather than treating the presence of a malicious file as proof that it ran.