A Bad File Is Only Part of the Story

When a malicious file is detected, it can be tempting to treat that file as the entire threat.

Malware detection requires more than simply recognizing a bad file.

Following the attack beyond the initial file uncovers the persistence mechanisms and other activity that also must be addressed.

BotHelper illustrates a longstanding challenge in malware detection: individual artifacts and behaviors rarely tell the full story of an attack.

While recognizing a malicious file remains an important baseline, preserving the connections between delivery, execution and subsequent activity allows defenders to accurately reconstruct how an attack unfolded and what needs to be addressed.