Does it mean the same as to eliminate or disarm the threat or does it mean that the malware was activated/executed (whether it reached its target or detonated in a "controlled" manner, e.g., in a sandboxed environment)?

  • 8
    "detonate malware" is not a standard term. Can you provide context for where you read this phrase?
    – schroeder
    Apr 18, 2017 at 9:45
  • I've seen it used a lot in various articles across the web (blogs, technet posts, data sheets, etc.) in the context of malicious files, email attachments, and so forth. I couldn't find a formal definition, though. Guess I'll wait to get a few more responses from people who are familiar with the term and how it is typically used. Thanks!
    – EricomGal
    Apr 18, 2017 at 10:28
  • Then I think it might be situationally specific, too. I can imagine using the term, but it would be not a universally defined term.
    – schroeder
    Apr 18, 2017 at 11:04
  • 3
    I googled for "detonate malware" and got 1520 hits, the top hit being this question. I'm not really sure that qualifies. Please provide some links to where you have seen the term used.
    – user
    Apr 18, 2017 at 11:04
  • A few sources that I imagine are sufficiently reputable include: technet.microsoft.com/en-us/library/mt148491(v=exchg.150).aspx infosecurity-magazine.com/opinions/… blogs.cisco.com/security/…
    – EricomGal
    Apr 18, 2017 at 12:13

3 Answers 3


"Detonating malware" means that the marketing team behind the product you are reading about realized that they need to figure out new catchy terms to get your attention. After hours of creative meetings they came up with the (wrong) malware-explosive analogy and decided to use the word "detonation" to describe a random event of the overly simplified scenario sketched up on their whiteboard.


Depending on who you ask (and what side of the fence you are on) it can mean two different things in my experience.

First (and most accurate in my opinion), is that that a payload will be triggered in a sandboxed environment to isolate and analyze it. Researchers and vendors will do this to to identify if a particular payload contains malware and then try and learn from it.

On the other side of the fence, it could mean that a piece of malware has been sitting dormant and given a specific input or condition it will be triggered and do whatever it was designed to do.


from 10/16/19 article https://www.microsoft.com/security/blog/2019/10/16/top-6-email-security-best-practices-to-protect-against-phishing-attacks-and-business-email-compromise seen in two sentences: Solutions that include rich detonation capabilities for files and URLs are necessary to catch payload-based attacks. Capabilities like detonation that scan suspicious documents and links when shared are critical to protect users from targeted attacks

  • 1
    This may be so, but it doesn't explain what detonation is, as requested in the question.
    – Chenmunka
    Oct 24, 2019 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .