What evidence may show malware execution?¶
Malware execution should be supported by evidence that code actually ran on the system.
Avoid the dangerous assumption¶
The dangerous assumption is that a detection name or file timestamp is enough.
It may not be.
Possible execution evidence includes:
- process-creation records
- parent and child processes
- command-line activity
- memory artefacts
- application execution traces
- loaded modules
- registry or service changes
- scheduled tasks
- file creation
- network connections
- security-product telemetry
- user interaction
- crash or error records.
No single artefact is universal.
The available evidence depends on the operating system, logging configuration, security tools, time elapsed and whether the system was altered after the event.
Investigators should reconstruct the process chain.
What launched the code?
Which account context did it use?
What child processes appeared?
What files or settings changed?
What network activity followed?
Did the security product block or terminate it?
A file being opened may not mean its malicious content executed. A process starting may not mean every function completed.
Corroboration is stronger where several independent records align in time.
Be cautious with timestamps. File creation, modification and access times can be changed by copying, extraction, scanning or system processes.
Where malware may have operated only in memory, restart or shutdown may remove important evidence.
Where one record is absent, do not invent certainty from another. A network connection may support execution, but it should be linked to the relevant process rather than assumed from timing alone.
Operational takeaway¶
Use process, memory, system-change and network evidence together to show execution and distinguish attempted, interrupted and completed behaviour.