0

Does it mean the same as to eliminate or disarm the threat or does it mean that the malware was activated/executed (whether it reached its target or detonated in a "controlled" manner, e.g., in a sandboxed environment)?

  • 8
    "detonate malware" is not a standard term. Can you provide context for where you read this phrase? – schroeder Apr 18 '17 at 9:45
  • I've seen it used a lot in various articles across the web (blogs, technet posts, data sheets, etc.) in the context of malicious files, email attachments, and so forth. I couldn't find a formal definition, though. Guess I'll wait to get a few more responses from people who are familiar with the term and how it is typically used. Thanks! – EricomGal Apr 18 '17 at 10:28
  • Then I think it might be situationally specific, too. I can imagine using the term, but it would be not a universally defined term. – schroeder Apr 18 '17 at 11:04
  • 3
    I googled for "detonate malware" and got 1520 hits, the top hit being this question. I'm not really sure that qualifies. Please provide some links to where you have seen the term used. – a CVn Apr 18 '17 at 11:04
  • A few sources that I imagine are sufficiently reputable include: technet.microsoft.com/en-us/library/mt148491(v=exchg.150).aspx infosecurity-magazine.com/opinions/… blogs.cisco.com/security/… – EricomGal Apr 18 '17 at 12:13
3

"Detonating malware" means that the marketing team behind the product you are reading about realized that they need to figure out new catchy terms to get your attention. After hours of creative meetings they came up with the (wrong) malware-explosive analogy and decided to use the word "detonation" to describe a random event of the overly simplified scenario sketched up on their whiteboard.

1

Depending on who you ask (and what side of the fence you are on) it can mean two different things in my experience.

First (and most accurate in my opinion), is that that a payload will be triggered in a sandboxed environment to isolate and analyze it. Researchers and vendors will do this to to identify if a particular payload contains malware and then try and learn from it.

On the other side of the fence, it could mean that a piece of malware has been sitting dormant and given a specific input or condition it will be triggered and do whatever it was designed to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.