Files

Detecting Malicious Files: A Comprehensive Approach

Malicious files serve as a cornerstone of many cyberattacks, providing attackers with tools for persistence, data exfiltration, or remote control. Identifying these files is critical in incident response. Below, we explore both manual and automatic detection methods.

---

1. Manual Detection

Manual analysis focuses on investigating suspicious files based on specific timeframes, file attributes, and unusual behaviors.

Steps for Manual Detection:

A. Determine the Timeframe

• Identify the time window when the suspicious activity occurred.

• Use this to focus on files created or modified during that period.

Command-Line Approach:

find / -type f -newermt "YYYY-MM-DD HH:MM:SS" ! -newermt "YYYY-MM-DD HH:MM:SS"

B. Search for Suspicious Files

• File Explorer:

  1. Open File Explorer.

  2. Navigate to suspected directories (e.g., C:\Users\Public, C:\Windows\Temp).

  3. Use the Search tab to filter files by Date Modified.

C. Focus on Common Malicious Extensions

Look for files with extensions often used for executables or scripts:

• .exe (executable files)

• .bat (batch scripts)

• .cmd (command scripts)

• .vbs (Visual Basic scripts)

• .ps1 (PowerShell scripts)

• .dll (dynamic link libraries)

Example PowerShell Command:

Get-ChildItem -Path C:\ -Recurse -Include *.exe, *.bat, *.cmd, *.vbs, *.ps1, *.dll | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)}

Advantages of Manual Methods

• Targeted Review: Human oversight can spot suspicious patterns or files in unexpected locations.

• Bypass Detection: Can identify malware that has evaded automated scanners through obfuscation or novel behaviors.

Challenges

• Time-Consuming: Reviewing files manually requires significant time, especially on systems with large file volumes.

• Requires Expertise: Relies on the analyst’s ability to recognize malicious patterns or anomalies.

---

2. Automatic Detection

Automated tools leverage predefined signatures, heuristics, and behavioral analysis to detect malicious files efficiently.

Steps for Automatic Detection:

A. Run a Full Disk Scan

Use antivirus or specialized malware scanners:

• Antivirus Tools:

  • Microsoft Defender

  • Symantec

  • McAfee

• Specialized Malware Scanners:

  • Malwarebytes

  • ESET Online Scanner

  • Sophos Clean

B. Review Scan Results

After the scan:

• Investigate flagged files.

• Pay attention to quarantined or potentially unwanted programs (PUPs).

C. Behavior-Based Detection

• Some tools (e.g., CrowdStrike, Cylance) use behavioral analysis to detect malware by observing anomalous actions.

---

Limitations of Automatic Methods

• Evasion Techniques: Advanced malware often uses obfuscation or encryption to bypass traditional AV detection.

• False Negatives: Customized or zero-day malware may not match known signatures.

---

Supplemental Analysis

Combining manual and automatic detection methods enhances detection accuracy.

Hybrid Workflow:

1. Run an Automated Scan: Use AV tools for a preliminary sweep.

2. Manual Review:

   • Focus on time-correlated files missed by automated tools.

   • Investigate unknown or unsigned executables flagged by AV.

---

Key Takeaways

Method	Use Case	Strengths	Limitations
Manual	Focused on known timeframes and custom analysis	Effective for novel or customized malware	Time-intensive, expertise-dependent
Automatic	Broad file scanning using AV or malware scanners	Fast and efficient for known threats	Vulnerable to evasion techniques

Combining both methods provides a comprehensive approach to detect and analyze malicious files, ensuring a robust incident response.