title: Malicious Software Detection
id: 33db94d5-bc40-55e5-a122-803f79293d9e
custom_id: wf-mal-005
status: stable
level: high
description: |
    Detects malicious software identified by endpoint protection platforms
    (EPP) or endpoint detection and response (EDR) solutions forwarding
    alerts through WitFoo's artifact ingestion pipeline.
author: WitFoo
date: 2026-02-21
tags:
    - attack.execution
    - attack.t1204
references:
    - https://attack.mitre.org/techniques/T1204/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "malicious_software"
    condition: selection
fields:
    - clientIP
    - fileName
    - fileHash
    - filePath
    - program
    - matchedLeadRules
    - ruleName
falsepositives:
    - False positive detections by antivirus engines
    - Legitimate hacking/security tools (Metasploit, Mimikatz in lab)
    - PUP (potentially unwanted program) detections