Propagation Mechanism
Definition
The method by which malware copies itself to new hosts. Viruses attach to host files; worms exploit network services autonomously; trojans rely on user deception. The propagation mechanism determines the attack surface and the network-level artefacts visible during investigation.
- Virus method
- Attaches to and infects host files
- Worm method
- Self-replicates over network services, no host file
- Trojan method
- Relies on user deception to execute
- Investigative value
- Shapes which network and file-system artefacts to search
Common questions
Why does propagation mechanism matter to an incident responder?+
It narrows the search: a worm leaves network-scan and exploit artefacts across many hosts, while a trojan leaves a single deceptive delivery path such as an email attachment or a fake installer, so the mechanism tells the responder where to look first.
Can a single malware sample use more than one propagation mechanism?+
Yes. Modern malware families are often modular, combining a trojan-style initial delivery with worm-like lateral movement once inside a network, which is why classification by mechanism is treated as descriptive rather than a strict category.
Related terms
- Command and Control (C2)
- The channel through which an attacker sends instructions to malware on a compromised host and receives data back. C2 channels range from...
- Dropper
- A malware component whose sole function is to deliver and install a secondary payload. The dropper itself may be a trojan, a...
- Payload
- The action the malware performs once active: data encryption (ransomware), credential theft (banking trojan), resource hijacking (cryptominer), or system destruction (wiper). The...
- Persistence Mechanism
- The technique malware uses to survive a reboot or user logout. Common methods include registry run keys, scheduled tasks, Windows services, cron...
- Rootkit
- Malware designed to hide its own presence by subverting the operating system's reporting functions. User-mode rootkits hook API calls; kernel-mode rootkits modify...