Antivirus signature

A signature does not appear on its own: somebody writes it. An analyst gets a malware sample and looks inside it for something stable enough to recognise it again and specific enough not to match anything else. That something might be the hash of the whole file, which is exact but brittle, a byte sequence with gaps in it, or a rule about the structure of the file. YARA is the language much of the industry writes those rules in.

From there the engine does the obvious thing: it compares what it sees against a database that updates several times a day, and when something matches it blocks, quarantines or deletes it. It is cheap, it is fast and it rarely gets things wrong in the way that hurts, which is flagging what it should not.

It is worth seeing what a signature is outside the product, too: it is the same kind of artefact as an indicator of compromise published in a report so that others can look for the same thing at home. What changes is who consumes it, not what it is.

A signature describes a SAMPLE, not a behaviour. That is the whole limitation, and everything else follows from it. Recompiling with a different flag, running the binary through a packer or changing a single byte already breaks the match, and there are tools that produce a different executable per victim, so the set of what counts as “known” is far smaller than a database with millions of entries suggests. Against something nobody has seen yet, such as a zero-day, no signature helps, because there is no sample to derive one from.

And there is a worse case, which is when there is no file. An attack that runs in memory, or that leans on the programs already installed on the machine, leaves nothing on disk to compare against anything. There, fileless malware is not evading the signature: it simply never enters its territory.

That is why the industry moved towards EDR, which records what a process does and decides on behaviour, so it can react to something it has never seen. What should not be concluded from that is that signatures are spare. They remain the cheapest and most precise thing available for what is already known, and they are the layer that clears the noise so the expensive layer only has to deal with what is left.

On a red team engagement we do not test whether the antivirus has the signature, because that question already has an answer and it is not an interesting one. We build something that engine has never seen, which is neither rare nor sophisticated, and watch what happens. What decides the outcome is almost never the engine: it is the two things around it, whether anything was recorded and whether anyone read it.

The finding that repeats most has exactly that shape: the alert did fire, it fired in the small hours, whoever was on shift closed it as a false positive and nobody went back to it. That is not fixed by changing product, it is fixed with detection engineering, which is what turns an alert into a rule that means something and into somebody whose job is to look at it.