Forgive me if it's a silly question, but I'm genuinely curious.

How do traditional AV (signature-based only) vendors get the malware to analyse and include in definition files?

Also, what's the process of determining that it's bad, for it to be included in the definition file?



There are a bunch of ways:

  • Customer directly provides a sample when they get infected or breached, or an analyst finds a sample during incident response or in the process of running a SOC.
  • Sample matches a previously made signature but isn't the same, so gets analysed for more general indicators of compromise (IOCs) for that malware family.
  • Someone uploads a sample to VirusTotal or a similar service. If a few AVs pick up a sample but others don't, the others can take a look too.
  • Security products offered by the same vendor (or a partner vendor) picks up an indicator of compromise based on a heuristic, and sends the sample for analysis. This is how a lot of the Cisco security products work, particularly Umbrella.
  • Honeypots operated by the AV vendor. These can be standalone systems on the internet, or they can be email accounts where attachments and links are automatically analysed.
  • On forums and chat groups operated by malware analysts for the purposes of sharing samples.
  • From forums where criminal groups sell malware kits, e.g. banking trojans.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.