Malware Is a Behavior, Not Just a Name

The word malware is short for malicious software, but that definition is too broad to help a defender make decisions.

A useful investigation asks:

• How did the software arrive?
• What does it try to do?
• What part of the system does it affect?
• How does it persist or spread?
• What evidence would reveal the behavior?
• Which defensive control interrupts the behavior?

That is the difference between memorizing malware names and understanding security threats.

Start with behavior

Common malware categories describe different behaviors.

Virus

A virus attaches itself to another file or program and spreads when the infected host is executed or shared.

Worm

A worm is designed to spread between systems, often with less direct user involvement than a traditional virus.

Trojan

A trojan pretends to be useful or legitimate while delivering unwanted behavior.

Ransomware

Ransomware blocks access to data or systems, often by encrypting files, and demands payment or another action.

Spyware

Spyware secretly collects information about a user or system.

Keylogger

A keylogger records keystrokes. It can expose credentials, messages, or other sensitive input.

Adware and potentially unwanted software

Some software aggressively displays advertisements, changes browser behavior, or installs unwanted components. The security impact depends on what the software actually does and how it arrived.

Rootkit

A rootkit is designed to hide malicious activity or maintain privileged access by modifying or manipulating low-level system behavior.

These labels can overlap. A single campaign may use a trojan for delivery, install spyware, and add persistence mechanisms.

Do not force a complex incident into one vocabulary word if the evidence supports several behaviors.

Concept flow

Analyze malware from evidence, not from a scary filename

Defensive analysis starts with observable indicators, connects them to behavior and impact, then chooses a mitigation that matches the evidence.

1. ARTIFACTteacher-provided sample, report, hash, or behavior record
   inspect
2. INDICATORSfiles changed, persistence, network activity, messages, processes
   support
3. BEHAVIORwhat the software appears to do
   creates
4. IMPACTwhich systems, data, or CIA properties could be affected
   reduce with
5. MITIGATIONupdates, isolation, backups, filtering, user controls, or recovery

Use that flow as the investigation order for the synthetic evidence sets below. Start with what you can observe, not with the malware family name you expect to find.

Connect malware to the CIA Triad

Malware becomes easier to reason about when you ask what it threatens.

The exact effect depends on the incident.

Do not say "ransomware only affects availability." Some ransomware incidents may also involve data theft. Do not say "spyware only affects confidentiality" if the software also changes settings or installs components.

Use the evidence in the scenario.

Infection chain

A malware incident usually has stages.

Consider this fictional chain:

1. A student downloads a fake game utility.
2. The file runs with the user's permissions.
3. It creates a new startup entry.
4. It contacts an external service.
5. Browser credential data is copied.
6. The program attempts to remain active after restart.

You can describe that as a chain:

delivery → execution → persistence → communication → collection

A defender can interrupt the chain at multiple points.

• block or warn on suspicious downloads
• restrict unnecessary privileges
• monitor startup changes
• filter suspicious communication
• protect stored credentials
• restore from a known-good state when necessary

There is rarely one magical control.

Evidence lab: classify the behavior

You are given four synthetic evidence sets.

Set A

• file name: free_skin_pack.exe
• user launched it manually
• new process creates an autorun entry
• browser begins opening unwanted advertising pages

Set B

• no user launch is recorded
• multiple classroom test VMs begin sending the same unusual traffic pattern
• the activity appears shortly after one VM becomes infected

Set C

• files in a fictional documents folder receive new extensions
• a note appears demanding payment
• users can no longer open the original files

Set D

• a background process records keystroke-like input events
• the process writes data to a hidden local file
• no destructive file changes are observed

For each set:

1. identify the most likely malware behavior or category
2. cite the evidence that supports the classification
3. identify the CIA property most directly affected
4. name one thing the evidence does not prove
5. recommend one defensive control

Malware versus ordinary software failure

Not every strange computer problem is malware.

A slow laptop could be caused by:

• too many applications running
• low storage
• a failed update
• browser extensions
• hardware problems
• network congestion
• malware

A defender should not jump from symptom to accusation.

This is the same evidence discipline you practiced in Week 1.

Weak claim:

The computer is slow, so it has a virus.

Stronger claim:

The computer is slow. The current evidence does not establish the cause. I would need process, storage, network, and system information before classifying the problem.

Build a malware behavior map

Create a diagram with these columns:

Entry → Execution → Persistence → Impact → Evidence → Defense

Choose two of the synthetic evidence sets and map the complete chain.

Your map must include at least one control before execution and one control after execution.

Why both?

Because prevention can fail. Defensive systems also need ways to detect, contain, and recover.

The human factor

Malware often depends on human decisions:

• opening an attachment
• installing untrusted software
• approving a permission prompt
• disabling a warning
• using an administrator account for routine work

That does not mean "users are the problem."

A well-designed system expects people to make mistakes and adds controls that limit the consequence.

Security awareness is one control. Safer defaults, limited privileges, backups, application controls, monitoring, and recovery procedures are others.

Evidence for Lesson 1

Submit:

• your four evidence-set classifications
• your two malware behavior maps
• one paragraph explaining why a symptom such as "the computer is slow" is not enough to prove malware

Finish with:

The malware label matters less than the behavior when...

The goal of threat analysis is not to recognize scary names. It is to explain what the software is doing and where a defender can interrupt it.