Malware
In threat work, malware is hostile software written to act against the interests of the system it runs on: ransomware, infostealers, remote access tools, loaders, wipers and the rest. It is a means to an attacker’s end rather than the end itself, and defining an intrusion by the malware found in it usually describes the least important part of it.
How it works
It is more usefully classified by the job it does than by the label a vendor gives it. A loader establishes a foothold and fetches what comes next. A remote access tool provides interactive control. An infostealer collects credentials, session cookies and files and exits. Ransomware encrypts and extorts. A wiper destroys while looking like ransomware. A rootkit hides other activity.
Delivery is separate from function, which is why the same payload arrives by phishing attachment, by a compromised update, by a browser exploit or by an operator typing a command on a host they already control. And modern intrusions are increasingly modular: a broker sells access, a loader is dropped, and the eventual payload has nothing to do with whoever obtained the initial foothold.
What goes wrong
Detection built on identifying the file is a shrinking bet, for a structural reason: the file is the part the operator can change most cheaply. Recompiling, packing or generating a fresh build changes every hash and most signatures at no cost. Operations that never write a payload to disk at all, running in memory or entirely through signed system utilities, present nothing to sign in the first place.
The consequence for a defender is that behaviour is the durable signal: what the process did, what it accessed, what it connected to, what it launched. That is a detection engineering problem rather than a product selection problem.
The second error is treating removal as remediation. Deleting the payload without answering how it arrived, what credentials it collected and what else it installed leaves the intruder holding whatever they took, which is why incident response scopes before it eradicates.
Where this shows up in an audit
On an engagement we behave like an operator, not like a specimen: the tooling is built for the client and has never been seen by anyone, so any detection that fires is detecting behaviour rather than recognising a sample. That is the honest test of an endpoint control, and clients are frequently surprised by how far a custom implant travels before anything reacts. We record every artefact we place and hand back the full list so nothing of ours is left behind.