Behavioural Analysis
Definition
The examination of what a program does at runtime rather than what its code says at rest. Behavioural analysis captures the actual actions a sample takes, including those concealed by packing or encryption, and maps them to attacker intent.
- Focus
- Runtime actions of a malware sample
- Captures
- Actions hidden by packing or encryption
- Contrast
- Static analysis examines code without execution
- Output use
- Maps observed actions to attacker intent
Common questions
Why is behavioural analysis needed when static analysis exists?+
Packed or encrypted malware can defeat static code inspection because the malicious logic only unpacks or decrypts itself in memory at runtime. Behavioural analysis observes what the sample actually does when executed, so it catches capability that static review of the on-disk file would miss entirely.
What environment is behavioural analysis typically run in, and why?+
It is usually run in an isolated sandbox rather than on production or investigator hardware, so the sample's file, registry, network, and process activity can be logged safely without risking infection of the analysis network or tipping off a remote command-and-control server.
Related terms
- API Hooking
- A monitoring technique in which the sandbox intercepts calls the malware makes to operating-system API functions. Each intercepted call is logged with...
- Evasion Detection
- Malware logic that checks whether the execution environment is a real host or an analysis sandbox. Checks may query hardware identifiers, count...
- MITRE ATT&CK Mapping
- The process of classifying observed malware behaviours against the MITRE ATT&CK framework's taxonomy of adversary tactics and techniques. Sandbox platforms increasingly produce...
- Network Indicator
- A network-based artefact produced by malware at runtime, such as a DNS query, an IP address contacted, an HTTP request path, a...
- Sandbox
- An isolated execution environment, typically a virtual machine, where a malware sample runs under full instrumentation. The sandbox logs all system calls,...