What it means
Labels such as trojan, worm, ransomware, spyware, rootkit, downloader, and backdoor describe delivery, behavior, or purpose. One specimen can exhibit several categories at once.
Why it matters
Understanding behavior is more useful than relying only on a family name because defenders must contain what the malware is doing in the environment.
Practical focus
- Examine execution, persistence, network, and credential behavior
- Use multiple telemetry sources
- Contain affected identities as well as devices
- Preserve samples and evidence safely
Common mistakes
- Assuming a detection name fully explains impact
- Deleting a file without investigating persistence
- Reconnecting a cleaned device before credential risk is addressed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: