malware
Posts tagged “malware”.
Why is an app on my PC talking to a Tor exit node?
Usually because something on your PC accepts connections arriving through Tor, a peer-to-peer app met a Tor user, or a program uses Tor itself. Malware does too, so check the app and direction.
The upload pattern that should worry you
Worry when one program uploads far more than it downloads, in bulk, to a place you can't explain. That's the shape of data theft. Backups and sync look the same, so context decides.
Why you need a firewall and an antivirus, and what each one misses
An antivirus judges files and program behavior; a firewall judges connections. Each misses what the other sees, from a clean-looking tool phoning out to malware that never touches the network.
How to cut an infected PC off the network in one step
Contain first: stop the PC talking to the network so malware can't take orders, send data out or spread. On one PC, use Block all outbound (panic). On a managed fleet, use Isolate (beta).
Living off the land: when Windows' own tools go rogue
Attackers often skip custom malware and use tools Windows already ships, such as PowerShell, certutil and mshta. The files are genuine, so the tell is behavior, like those tools reaching the internet.
How to spot malware by its network traffic
Almost all malware has to talk to someone. Look for unknown or unsigned programs online, odd ports, check-ins on a timer, lopsided uploads, threat-listed addresses and Windows tools going online.
Threat-intelligence IP lists: what they catch and what they miss
Threat-intelligence IP lists name addresses already tied to botnets, hacked machines, spam networks or Tor. They catch known infrastructure well but miss new servers and can mislabel shared addresses.
When a trusted app's file suddenly changes
A trusted app's file changing usually means an update. Worry when the change brings a lost or broken signature, or new destinations — the marks of a tampered, supply-chain-compromised app.
Unsigned programs on the internet: when to worry
An unsigned program going online isn't proof of malware; plenty of honest software is unsigned. Worry when it also runs from a temp folder, appeared minutes ago, or carries a broken signature.
What is beaconing? How malware checks in with its server
Beaconing is malware's regular check-in with its command-and-control server. The steady timing is hard to hide, so a program contacting one address like clockwork is worth a look.