An Endpoint Verdict Is Not a Malware Identification

“The agent flagged it as a known family and quarantined it, so we know what we are dealing with.”

Hold on.

That sentence is about to become the root-cause line in an incident ticket.

An endpoint verdict is a vendor’s label, not an identification.

The agent did something real.

It matched a file against its own detection logic.

It attached its own vendor’s name to the match.

It took an action it was configured and permitted to take on that operating system.

Three useful facts.

Not one of them says what the sample did on the host before the agent noticed it.

Not one says whether the same agent, on your other platforms, would have noticed it at all.

A family name in an alert is a sentence about the detector.

You are reading it as a sentence about the attacker.

Nobody would take a single lab’s shorthand for a pathogen, find that three other labs call it something else, and conclude the patient’s history is fully understood.

Put the shorthand in a console with a red badge and apparently the case is closed.

It isn’t.

1. “But the Verdict Came From a Reputable Engine.”

It probably did.

Reputable engines disagree with each other routinely, and nothing obliges them to stop.

Take Conficker, discovered in early November 2008.

Sophos detected it as Mal/Conficker-A.

ESET and CA as Win32/Conficker.A.

Symantec as W32.Downadup.

F-Secure as W32/Downadup.A.

Kaspersky as Net-Worm.Win32.Kido.bt.

McAfee as W32/Conficker.worm.

Trend Micro as WORM_DOWNAD.

Eight vendors.

Seven names.

One worm.

Every one of those engines was right that the file was malicious.

Only ESET and CA agreed on what to call it.

This was not a teething problem somebody later fixed.

An industry naming scheme was attempted in 1991, by the Computer Antivirus Research Organization, CARO.

Microsoft’s current convention still credits it as its structural basis.

What CARO never had was enforcement.

So each vendor built its own descendant grammar.

Microsoft’s is Type.Platform.Family.Variant[!Suffix].

Kaspersky’s is [Prefix:]Behaviour.Platform.Name[.Variant], with its own family vocabulary underneath.

Same ancestor, and no machine maps one onto the other without a translation layer.

Microsoft’s own documentation says it plainly: security software providers sometimes use different names for the same malware family.

When a genuinely new family turns up, there is no submission-and-review body a vendor answers to before naming it.

Whichever vendor publishes first tends to set the name that sticks in trade press.

A reputable engine gives you a reputable label. A label is not a consensus.

Reputable engines are also sometimes wrong about whether a file is malicious at all.

On 21 April 2010, McAfee’s DAT 5958 definition update identified svchost.exe, a core Windows file, as the W32/wecorl.a virus.

Affected Windows XP SP3 machines lost network connectivity, rebooted in loops or blue-screened.

That was a detection false positive.

The July 2024 CrowdStrike outage was a different animal, a content-update logic defect rather than a verdict.

Keep the two apart.

2. “But Dozens of Engines on VirusTotal Flag the Same File.”

Then dozens of engines think the file is bad.

That is a count of verdicts.

It is not agreement on what the file is.

VirusTotal inspects items with over 70 antivirus scanners and URL and domain blocklisting services, and republishes each engine’s verdict and detection name next to the computed hashes.

Read the detection-name column, not the ratio.

A 2021 study took 2.47 million Android malware samples through VirusTotal’s top 10 engines.

For samples where a family name could be identified at all, the best-agreeing pair of engines, ESET-NOD32 and Ikarus, agreed on family name no more than 29% of the time.

The strongest pair in the dataset.

Every other pairing did worse.

So a detection ratio tells you something about maliciousness.

It tells you almost nothing about family, and nothing at all about your host.

A wall of red on the scan page is not a second opinion on identity.

It is several dozen first opinions, each in its own dialect.

3. “But We Have the Hash, So We Can Hunt for It Everywhere.”

You can hunt for that file everywhere.

You will find exactly that file.

A cryptographic hash, MD5, SHA-1, SHA-256, is computed from the bytes.

A single altered byte changes every one of them completely.

So a hunt keyed only to the quarantined sample’s SHA-256 finds identical copies and misses every repacked sibling.

That is not an edge case.

The AV-TEST Institute reports registering over 450,000 new malicious programs and potentially unwanted applications every day.

Most of that volume never receives a family name from any vendor.

It is tracked by hash, or by a generic heuristic label.

This is why analysts record more than one kind of hash.

ssdeep and TLSH are fuzzy hashes that flag near-duplicates across minor repacking.

Imphash fingerprints a Windows PE file’s import table, so two binaries calling the same Windows APIs in the same order match even if their bodies differ substantially.

All of these are static outputs.

None needs the file to run.

Packing is recorded as its own attribute too.

UPX, a legitimate compression tool and among the most commonly observed packers in malware campaigns, replaces section names with markers such as UPX0 and UPX1.

Where no packer signature matches, entropy analysis is the fallback: packed or encrypted sections commonly read in the 7-to-8 range on an 8-point scale.

The same packer wraps unrelated families.

The same family gets repacked with different tools between campaigns.

A cryptographic hash identifies bytes. Scoping needs the neighbours of those bytes.

4. “But the Family’s Behaviour Is Already Documented in ATT&CK.”

It is documented for the family.

Not for your sample.

MITRE ATT&CK gives each tracked malware family or tool a stable S-number.

S0367 is Emotet.

Its entry lists Geodo under Associated Software, the field formerly labelled Aliases, because different organisations track the same software under different names.

MITRE is not ruling on which name is correct.

It records that several names point at one tracked object.

That is cross-reference, not adjudication, and it is genuinely useful.

Now read what the page says about persistence.

Emotet’s documented set includes registry Run-key entries, newly created Windows services and scheduled tasks, used interchangeably or in combination depending on the variant.

Which one did yours use?

The family page cannot tell you.

Persistence technique is close to exclusively a dynamic-analysis finding.

A sandbox has to execute the sample and watch which keys, services or tasks it creates.

Command-and-control is split the same way.

Static analysis can pull hardcoded or lightly obfuscated C2 domains out of strings or a decrypted configuration block.

Infrastructure the sample reaches only at runtime, domains from a generation algorithm, addresses fetched from a dead-drop resolver, needs detonation in an isolated sandbox.

And the full shape of the infrastructure often comes from neither.

Qakbot’s disruption in the US rested on the FBI observing the botnet’s live check-in traffic, which identified more than 700,000 infected machines.

RedLine Stealer’s alleged operator was tied to a GitHub account by researchers following operational infrastructure over time.

No static read of a single sample produces either.

A family’s ATT&CK entry is a list of what that family has been seen doing. Your host’s record is what this sample did.

5. “But the Agent Quarantined It.”

It quarantined the file it matched.

That is an action on one object, on one host, at one moment.

Everything the sample did before the match is outside the action.

The registry key it may have written, the service it may have created, the domain it may have reached: none of those is a file the agent was pointed at.

Which is why the persistence question from the previous section is still open after a successful quarantine.

It gets worse when the thing the agent flagged is a component rather than the payload.

EDR killers load a legitimately signed but vulnerable driver to get kernel privilege and switch security software off.

An agent can flag that driver on the host in front of it.

Taking the driver out of circulation everywhere is not the agent’s job, and not your vendor’s either.

On 64-bit Windows, most drivers abused this way were signed through Microsoft’s Windows Hardware Compatibility Program.

Revocation and the vulnerable-driver blocklist are Microsoft’s levers.

They move slowly.

Sophos X-Ops reported a set of malicious signed drivers to Microsoft in December 2022.

Microsoft revoked them in its 11 July 2023 Patch Tuesday release: 133 drivers.

Of those, 100 were signed through the hardware program, 68 built to kill endpoint protection and 32 rootkits.

Another 13 protection killers and 4 rootkits were signed by other companies, and 16 were unsigned rootkit variants.

100 + 13 + 4 + 16 = 133.

The blocklist itself had its own clock.

In 2022, a fully patched Windows 10 21H2 install still carried driver-block rules dated 12 December 2019, because the list synchronized only at major releases until the KB5020779 preview fix in October 2022.

A quarantine is local and immediate. The fleet-wide fix for what was quarantined may be neither.

6. “But the Same EDR Product Runs on Every Laptop We Own.”

Same product.

Not the same controls.

EDR was named as a category in 2013, when Gartner analyst Anton Chuvakin coined “endpoint threat detection and response”.

It is framed as primarily an alerting tool rather than a protection layer.

What it can alert on, and do about it, depends on the operating system underneath.

Microsoft Defender for Endpoint documents its own gaps.

Full device isolation is supported on Windows 11, Windows 10 1703 and later, Windows Server 2012 R2 and later, and Azure Stack HCI 23H2 and later.

On macOS, it is selective isolation only, and only from client version 101.98.84.

Linux support exists, with its own list of prerequisites that must be enabled before the capability works.

Tamper protection is available on Windows 10 1709 and later, Windows Server 2016 and later, and macOS, where Microsoft says it works a little differently than on Windows.

One vendor.

One product family.

Materially different controls by fleet.

So “the agent quarantined it on the laptop” is a Windows fact, or a macOS fact, or a Linux fact.

It is not a statement about the rest of the estate.

If the same family landed on a Mac with an old client, the containment available is not the containment you just used.

If tamper protection is off on part of the fleet, the agent there is easier to switch off before it gets a vote.

“We have EDR deployed” is not one fact. It is one fact per platform, per version, per setting.

7. “But Our Vendor Scores at the Top of Independent Tests.”

Which test?

Which year?

Were they named?

AV-Comparatives’ 2024 Endpoint Prevention and Response test evaluated 12 products against multi-stage scenarios spanning compromise, internal propagation and asset breach.

Seven vendors were tested and named: Bitdefender, Check Point, CrowdStrike, ESET, Kaspersky, Palo Alto Networks and VIPRE.

They achieved certification.

Five more were tested and reported only as anonymized products A through E.

Seven plus five: the twelve.

The five scored between 90.7% and 96.7% combined, below the threshold the named seven cleared.

Vendor marketing rarely says which independent test a percentage came from, or whether the vendor chose to be named in it.

And note what that test measures.

Prevention and response against staged scenarios.

It does not measure whether the vendor’s family name for your sample matches anybody else’s.

A good test result is dated evidence about a product. It is not an identification of a file.

8. No, This Does Not Mean Vendor Verdicts Are Useless.

They aren’t.

A named detection is a legitimate trigger for investigation.

The vendor’s name points into that vendor’s research, its write-ups and its detection history.

An ATT&CK S-number carried beside it is a real cross-reference that lets two teams, or two vendors, know they are discussing the same tracked object.

Quarantine is a real action with a real effect on the file it touched.

The error is the word “so”.

The agent flagged it, so we know what it is.

The agent quarantined it, so we are done.

Neither follows.

The verdict starts scoping. It does not finish it.

9. What You Should Actually Do.

Record the detection with its provenance. The vendor’s detection name, the engine, and, where one exists, the ATT&CK S-number.

Write “Vendor X called it Y”, not “it was Y”.

Store more than one hash before hunting. Cryptographic hashes, plus ssdeep or TLSH, plus imphash for PE files.

Record the packer signature, or the entropy reading if nothing matched.

Then hunt on the neighbours, not only the twin.

Detonate before asserting behaviour. A sample that passes static screening goes into an isolated sandbox before anybody writes “no persistence” or “C2 blocked” in the ticket.

Static extraction gives you hardcoded C2.

It does not give you generated domains or dead-drop lookups.

Keep a per-OS capability table. For each platform and client version: which isolation mode is available, whether tamper protection is enabled, and which prerequisites are met.

Read it before assuming the containment you used on one laptop exists on the next.

Cite tests properly. Name the test and the year, and note whether the vendor was named in it.

A percentage with no test attached is marketing.

10. The Actual Model Is Not Complicated.

A detection name says: this vendor’s logic matched these bytes and called them this.

A cryptographic hash says: these exact bytes, and nothing else.

A fuzzy hash says: bytes that look like these.

A sandbox run says: this is what the sample did when it was allowed to run.

A per-OS capability table says: this is what the agent can do on this machine.

An independent test says: this is how a product performed, in that scenario, in that year.

An identification is what you have after all of those. The verdict is what you had before any of them.

Keep the verdict.

Stop writing it in the root-cause field.