Often used by traditional anti-virus vendors, hash (MD5) of all known malicious files are computed and stored in an anti-virus database. Each time a suspicious file is inspected, its MD5 is computed and then compared against the other files existing in the AV database. While this method is effective, fast and industry-tested, it requires daily upkeep of a huge database of known malware samples, often hundreds of megabytes, and daily endpoint updates. While maintaining this constant vigilance is still valuable and effective at combating known malware, it is still ineffective against fast-evolving malware and malware variants.

This script examines the suspected files/directories and matches strings as they are defined in the YARA rules with the file. YARA approach does a better job than AV in terms of covering more families of malware however still falls short in detecting newly created malware.

Virtual execution and sandboxing is the process of detonating malware within a controlled virtual environment and monitoring the post execution behavior. The nature of malware presents several challenges to this method. Malware is getting smart enough to recognize when it’s in a sandbox environment and learns to avoid them in the future if the sandbox isn’t invisible (and they usually aren’t). The other challenge with sandboxing is that it takes a long time for inspection, and often not broadly deployed at all parts of the network, or even at many organizations, allowing malware to bypass it.