Malware

What Malware Is

These terms describe malware and the labels applied to it:

Malware: Software deliberately deployed to violate a system’s security interests or authorized policies.
Virus: Malware that replicates by inserting its code into a host, such as a program or document.
Worm: Self-replicating malware that spreads between systems without a host program.
Trojan: Malware that presents itself as legitimate while performing hidden, unauthorized actions.
Backdoor: An unauthorized way to enter or control a system that bypasses its access controls.
Remote access trojan (RAT): A trojan carrying a backdoor that gives an operator remote control of a machine.
Ransomware: Malware that denies access to data or systems and demands payment for restoration.
Wiper: Malware that destroys data or makes it unrecoverable.
Spyware: Malware that covertly collects information about a person’s activities or communications.
Infostealer: Spyware that collects stored credentials, session tokens, financial data, and wallet secrets.
Rootkit: Software that conceals unauthorized activity by changing what the system or its tools report.
Adware: Software that displays advertising, often installed with inadequate disclosure.
Potentially unwanted program (PUP): Software whose behavior or installation practices conflict with the user’s expectations.

The Malware Lifecycle

These terms name the stages of a malware infection:

Infection mechanism: In the classic virus model, the code that finds and infects the next host.
Infection: How malware arrives and first executes on a machine.
Delivery: The dropper or loader activity that deploys the actual payload, often in stages.
Persistence: Arranging for malicious code to resume after logout, termination, or reboot.
Trigger: The condition under which a payload activates.
Communication: Contact with an operator to receive instructions and return results.
Payload: What the malware does: steal, encrypt, control, or sabotage.
Propagation: Spreading to other systems.

Infection

These terms describe how malware gets in:

Initial access: The attacker’s first foothold in the target environment.
Execution: Running attacker-chosen instructions on a machine.
Privilege escalation: Gaining greater authority on a compromised machine.
Lateral movement: Using access to one machine or account to reach others.
Exploit: Use of a vulnerability to make a system perform an unintended operation.
Zero-day vulnerability: A flaw for which no protective patch is available.
Zero-day attack: An attack that exploits a zero-day vulnerability.
N-day vulnerability: A flaw that has been public, usually through a patch, for N days.
N-day exploit: An exploit built from a patched flaw, used against machines not yet patched.
Malvertising: Malicious advertising that directs users to fake download sites.
Air gap: Separation of a system or network from direct connections to other networks.
AutoRun: A former Windows feature that ran a program named on newly inserted media.
USB drop attack: Leaving a flash drive where a target will find it and open its contents.
BadUSB: Altering USB device firmware so the device performs an unexpected function.
Human Interface Device (HID): The USB interface used by keyboards and mice.
Macro: A program stored in a document and run by the application that opens it.
Drive-by download: Delivery of unwanted software through a visited web page.
Zero-click attack: An attack that requires no interaction between the target and the attack content.
Supply chain compromise: Malicious code arriving through an update or dependency the victim trusts.

Social Engineering

These terms describe attacks on people rather than software:

Social engineering: Manipulating a person into revealing information or taking an action that weakens security.
Social proof: The tendency to do what others appear to be doing.
Security fatigue: Dismissing warnings because every program displays one.
Phishing: A deceptive message or site that impersonates a trusted source to induce an action.
Spear phishing: Phishing aimed at a particular person or organization using information about them.
Pretexting: Presenting an invented situation to justify a requested action.
ClickFix: A page that tells the visitor to fix a problem by running a command.
Typosquatting: Registering a domain that differs from a real one by a likely typing error.
Combosquatting: Registering a domain that combines a real brand name with additional words.
Vishing: Phishing by phone call.
Smishing: Phishing by text message.
SIM swap: Persuading a carrier to move a victim’s phone number to the attacker’s phone.
Passkey: A site-bound credential that signs a challenge instead of supplying a code.

Delivery

These terms describe the components that deliver a payload:

Multi-stage delivery: Dividing delivery across a sequence of components, each starting the next.
Dropper: A component that contains another payload and places it on the target.
Downloader: A component that retrieves a later component from the network.
Loader: A component that prepares and starts another component, often in memory.
Process injection: Placing code inside another running process and making it execute.
Process hollowing: Starting a legitimate program suspended, replacing its code in memory, and resuming it.
Fileless malware: Execution that does not depend on a payload executable stored on disk.
Living off the land: Using programs already present on a system for the attacker’s purposes.
Packer: A tool that compresses or encrypts an executable and restores it at run time.

Persistence

These terms describe where malware registers itself and how startup is verified:

Firmware: Software in nonvolatile storage that initializes or controls hardware.
Boot loader: The program that loads the operating system kernel and transfers control to it.
Unified Extensible Firmware Interface (UEFI): The interface between PC firmware and the operating system’s startup environment.
Boot sector virus: A virus that replaces the boot sector program so its own code runs first.
Bootkit: Malware that modifies the boot process to gain early execution.
Firmware implant: Malware that modifies code or data in firmware storage itself.
Secure Boot: Firmware verification of each boot component’s signature before it runs.
Trusted Platform Module (TPM): A protected cryptographic component that holds keys and integrity registers.
Measured boot: Recording a hash of each boot stage in the TPM before it runs.
Remote attestation: Proving a machine’s boot state to another system with a TPM-signed report.

Rootkits and Mobile Devices

These terms describe concealment and mobile malware:

User-mode rootkit: A rootkit that replaces programs or libraries outside the kernel.
Library interposition: Substituting one implementation of a library function for another.
Kernel-mode rootkit: A rootkit that changes the operating system itself, usually through a driver.
Cross-view detection: Comparing what the kernel reports with what the disk actually contains.
Trojanized application: A useful program altered to include hidden behavior.
Accessibility service: An Android service that reads screen content and operates interface controls.

Triggers and Communication

These terms describe when malware acts and how it contacts its operator:

Logic bomb: A destructive payload together with the condition that triggers it.
Command and control (C2): The exchange through which an operator directs compromised systems.
Exfiltration: Unauthorized transfer of collected information out of the environment.
Botnet: A collection of compromised machines (bots or zombies) under one operator’s control.
Transport Layer Security (TLS): The protocol that encrypts connections between a client and a server.
Domain Name System (DNS): The service that translates domain names into addresses and other records.
DNS tunneling: Embedding commands or data inside DNS queries and replies.
Recursive resolver: The DNS service that performs lookups on a machine’s behalf.
Authoritative server: The DNS server responsible for answering queries about a domain.
TXT record: A DNS record that holds text strings.
Dead-drop resolver: A public page or account that publishes the current controller address.
Domain generation algorithm (DGA): An algorithm that lets malware and operator compute the same candidate domain names.
Peer-to-peer control: Relaying instructions among infected machines instead of through one server.
Beaconing: Repeated check-in traffic that announces availability or requests work.
Sinkholing: Redirecting traffic for malicious infrastructure to a defender-controlled server.

Payloads

These terms describe what malware does:

Bearer token: A token usable by whoever possesses it.
Double extortion: Copying documents before encrypting them and threatening to publish them.
Distributed denial-of-service (DDoS): Flooding a target with traffic from many machines at once.

Detection

These terms describe how defenders find malware:

Malware signature: A pattern used to recognize known malicious content.
Static analysis: Examining a program without executing it.
Static heuristic: A rule that flags suspicious construction rather than one known sample.
Packing: Transforming an executable so a scanner cannot see its instructions until it runs.
Polymorphic malware: Malware that re-encrypts the same body with a new key in each copy.
Metamorphic malware: Malware that rewrites its own instructions into equivalent forms in each copy.
Behavioral detection: Evaluating a program’s actions during execution.
Dynamic analysis: Examining a running program, often in a controlled environment.
Dynamic heuristic: A rule that evaluates sequences of runtime events.
Endpoint detection and response (EDR): A system that records and correlates events on computers for investigation.
False positive: Legitimate activity identified as malicious.
False negative: Malicious activity that goes undetected.
Analysis sandbox: An isolated environment for running a suspicious program and observing it.
Antimalware Scan Interface (AMSI): A Windows interface that lets applications submit content to security software for scanning.
Reputation-based detection: Classifying a file, publisher, or domain from prior observations of it.
Telemetry: Recorded operational data collected from many machines for analysis.
Trusted computing base: The components whose correct operation is needed to enforce security.