What can antivirus detection prove?¶

An antivirus detection can prove that the product identified a file, process or behaviour matching its detection logic.

Avoid the dangerous assumption¶

The dangerous assumption is that the detection proves successful malware execution and compromise.

It may not.

The product may have:

• blocked a download
• quarantined a file
• terminated a process
• identified suspicious behaviour
• detected an inactive copy
• flagged a potentially unwanted application
• matched a known signature
• applied a heuristic or machine-learning assessment.

Ask for:

• the product name and version
• the detection name
• the affected path or process
• the time
• the action taken
• whether execution was observed
• the underlying event details
• the rule or detection basis
• the final analyst assessment.

Detection names are vendor labels. The same sample may receive different names from different products.

A label may refer to a malware family, behaviour, generic category or confidence assessment.

Do not treat the detection name as proof of authorship, campaign or offender group.

Antivirus may miss malware, and it may also identify legitimate or dual-use tools as suspicious.

The strongest evidence comes from combining the detection with process, file, memory, network and user activity.

Preserve the original alert and export before the product’s retention expires.

Also record whether the product’s classification changed after analysis. Initial generic detections are sometimes replaced with more specific or less severe assessments as further information becomes available.

Preserve that classification history.

Operational takeaway¶

Use antivirus detection to locate and prioritise evidence, but establish execution, effect and attribution from the underlying records rather than the product label alone.