Catalog
concept#Security#Observability#Platform#Software Engineering

Malware

Fundamental concept of malicious software, its types, propagation methods, and impacts on systems and organizations.

Malware denotes malicious software designed to compromise systems, exfiltrate data, or enable unauthorized control.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Intermediate

Technical context

SIEM solution for log correlationEDR/endpoint solution for telemetry and containmentThreat intelligence platform for IOC management

Principles & goals

Defense-in-depth: layered protections reduce malware success.Least privilege: restricting rights reduces propagation paths.Share indicators: systematically exchange and correlate relevant IOCs.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Data loss or exfiltration by undetected malware.
  • Operational disruption from encryption or sabotage.
  • Reputational and legal risks from compromised systems.
  • Centralized collection and long-term retention of relevant telemetry.
  • Automated playbooks for common malware scenarios.
  • Close collaboration between security, IT and product teams.

I/O & resources

  • Network telemetry (flows, DNS, proxy logs)
  • Endpoint logs and process metadata
  • Threat intelligence feeds and IOCs
  • List of IOCs and hunting indicators
  • Containment and remediation actions
  • Forensic reports and lessons learned

Description

Malware denotes malicious software designed to compromise systems, exfiltrate data, or enable unauthorized control. It includes viruses, worms, trojans, ransomware and spyware as well as advanced polymorphic families. The concept covers attack vectors, propagation mechanisms and attacker motives and informs prevention, detection and incident response strategies.

✔

  • Increased resilience via targeted detection and response strategies.
  • Improved risk understanding through classification of malware types and TTPs.
  • Clear guidance for forensics and recovery after incidents.

✖

  • Constant evolution: signature-based methods quickly become obsolete.
  • False positives/negatives in heuristics and machine-learning approaches.
  • Limited usefulness without context and comprehensive telemetry.

  • Detection rate

    Share of malware incidents detected out of all actual incidents.

  • Mean Time to Detect (MTTD)

    Average time between initial compromise and detection.

  • Number of confirmed incidents per period

    Count of validated malware incidents within a defined period.

WannaCry outbreak (2017)

Ransomware that encrypted systems globally and impacted critical infrastructure; source of lessons learned on patch management and segmentation.

Emotet campaigns

Modular malware family that acted as a loader and enabled extensive credential theft and spam campaigns.

NotPetya (2017)

Destructive malware with massive propagation via network mechanisms; example of supply-chain and network risks.

1

Inventory existing telemetry sources and integrations

2

Configure detection rules and baselines in SIEM/EDR

3

Establish an incident response process including playbooks

4

Regular exercises and postmortems for improvement

⚠️ Technical debt & bottlenecks

  • Legacy endpoints without EDR remain hard to analyze.
  • Fragmented log infrastructure complicates correlation.
  • Outdated signature databases and missing feature updates in detection tools.
Real-time detectionForensic analysis capacityAlert volume / signal-to-noise
  • Overblocking telemetry sources leading to blind spots.
  • Uncritical IOC distribution without context causes alert fatigue.
  • Deploying untested detection scripts in production hinders forensics.
  • Relying on single tools instead of process and data integration.
  • Lack of alert prioritization by risk context.
  • Insufficient raw telemetry retention for retrospective analysis.
Malware analysis and reverse engineeringNetwork forensics and log correlationIncident response and threat hunting
Fast detection time and low false-positive rateScalable telemetry aggregation and correlationIntegration capability with forensic and response tools
  • • Legal requirements for handling telemetry and personal data
  • • Limited storage and analysis capacity for high telemetry volumes
  • • Heterogeneous system landscape complicates standardized detection