Malware

Malware is software developed with malicious intent. It steals data, gives attackers access, encrypts files or disrupts systems.

How it works

Malware includes various types: viruses, worms, Trojans, ransomware, spyware and infostealers. It usually reaches systems via phishing attachments, manipulated downloads, vulnerabilities or infected storage media. Modern malware obfuscates itself, downloads modules from the internet and communicates with a command-and-control server. Many attackers now partly avoid dropping their own files and use the operating system's built-in tools instead.

A practical example: An employee installs a supposed browser extension. It is an infostealer that reads saved passwords and session cookies. Two days later, an attacker uses this data to log into a cloud service. The SOC links the login to the EDR Alert and blocks the account.

What to look out for

• Traditional antivirus detects known patterns. New variants require EDR with behavioural analysis.
• Restrict administrator rights on endpoints. This makes installation more difficult.
• Block dangerous attachments and macros from the internet.
• Watch out for infostealers. They are often the first step towards larger attacks.
• After an infection, consider all credentials on the device as compromised.

Use of sandboxes

Suspicious files can be executed in an isolated environment. The sandbox observes the file's actions and provides indicators for investigation. However, some malware detects sandboxes and behaves inconspicuously within them.

Typical mistakes

Often, only the file is removed after a detection. Stolen credentials and downloaded tools are then overlooked. A second mistake is rebuilding a system without securing evidence.

How we implement it

We detect malware using EDR and behavioural rules, isolating affected devices as part of our mandate. We check related accounts and sessions in the same Case.