Behaviour Over Signatures: Triaging Malware by What It Does
What is it?
Behavioral triage judges a suspicious file by what it does when it runs, not by what it is made of. Instead of matching a static signature to the bytes, you read a detonation report — the processes it spawned, the files and registry keys it touched, the network it reached — and classify the sample by its actions. This is triage, not reverse engineering: you decide capability and severity, you do not disassemble the code.
Why it matters
Modern malware defeats static signatures on purpose: packing, encryption and polymorphism change the bytes on every build, so the same behaviour wears a thousand different faces. Signatures catch only what has been seen before. Behaviour is far harder to disguise — a credential stealer must still read credentials, ransomware must still encrypt files — so behavioral triage catches families a signature has never met.
Where you see it
Behavioral evidence comes from a detonation: a sandbox or EDR runs the sample in an isolated environment and records what it did — process creation (Sysmon), file and registry writes, and network connections (DNS and firewall logs). The analyst reads this report; in this course the reports are synthetic and no live sample is ever executed.
What normal looks like
A benign program behaves within its declared purpose: an installer writes to Program Files and registers one service; an updater checks a vendor endpoint and exits. The actions are few, explainable, and consistent with what the software claims to be — and they map to a known product.
What suspicious looks like
Malicious behaviour is a chain of actions no ordinary program needs: copying itself into a user-writable folder, writing a persistence key, injecting into another process, reading browser credential stores, then beaconing to a rare destination. It is the combination — and its mismatch with any legitimate purpose — that convicts, not any single action.
How analysts investigate
Read the detonation report as a story of actions grouped into four questions: how does it run and persist, how does it hide, what does it steal or damage, and how does it communicate. From those you name the sample's capability, judge its severity, and decide the response — all without opening a disassembler.
Common beginner mistakes
- Trusting a clean static/antivirus verdict — a signature miss means unseen, not safe.
- Calling a sample benign from one harmless-looking action instead of reading the whole chain.
- Trying to reverse-engineer the binary when triage only needs its behaviour and capability.
What you will be able to do
- Explain why static signatures miss modern malware and behaviour does not.
- Read a detonation report as a chain of actions in four categories.
- Separate malicious behaviour from a benign program's declared purpose.
A static signature asks 'have I seen these exact bytes before?'. Attackers answer that cheaply — pack, encrypt or recompile the sample and the bytes change while the behaviour does not. So the Tier-2 approach flips the question to 'what does it do when it runs?'. A credential stealer must still touch the credential store; ransomware must still encrypt; a backdoor must still call home. Behaviour is the part the attacker cannot easily give up.
| Behaviour category | Question it answers | Example action |
|---|---|---|
| Execution & persistence | How does it run and survive? | Copies to AppData, writes a Run key |
| Defense evasion | How does it hide? | Injects into a trusted process |
| Collection / impact | What does it steal or damage? | Reads browser credentials; encrypts files |
| Command & control | How does it communicate? | Beacons to a rare destination |
Worked example — what does this sample do?
PROC copies self -> C:\Users\Public\svchost32.exe
REG writes HKCU\...\Run value 'updater' = svchost32.exe
PROC injects into explorer.exe
FILE reads Chrome 'Login Data' store
NET beacons update.evilhost.tld every 60sThe answer: not safe at all — the clean scan only means unseen. Read the actions by category: it persists (copies to a public folder, writes a Run key), evades (injects into explorer.exe), collects (reads the browser credential store), and communicates (beacons to a rare host). No installer or updater needs to do any of this, and certainly not all four together. The static verdict was silent; the behaviour is unambiguous — this is a credential-stealing backdoor.
Recap
- Static signatures catch only the seen; packing and polymorphism defeat them cheaply.
- Behaviour is far harder to disguise — read a sample by what it does, not what it is.
- Group the actions into execution/persistence, evasion, collection/impact and C2.
Sign in to save your progress on the server.