Generic Detection Threats

Threat Class: Cyber Threat / Generic Detection Tracked Families: 2 Severity: HIGH MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Generic Detection encompasses a distinct class of malicious software engineered to compromise computing environments, subvert security perimeters, and execute unauthorized actions on victim systems. Threats in this category leverage modern evasion tradecraft, persistent execution mechanisms, and multi-stage infection vectors to target enterprise infrastructure and individual users alike. Systematic threat intelligence, endpoint detection, and incident containment are essential to mitigate organizational exposure.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Think You've Been Hacked? What To Do First

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID Technique Tactic Observed Operational Behavior
T1059 Command and Scripting Interpreter Execution Executes automated commands and shell scripts on target endpoints.
T1055 Process Injection Defense Evasion Injects malicious logic into legitimate processes to bypass endpoint security.
T1547 Boot or Logon Autostart Execution Persistence Establishes automated persistence mechanisms across system restarts.
T1071 Application Layer Protocol Command & Control Communicates with remote operator infrastructure using standard web protocols.

Actively Weaponized Exploits & Vulnerabilities

While primary payloads in generic detection threats predominantly leverage social engineering, phishing attachments, or credential reuse, see our authoritative CVE Exploitation Matrix for software vulnerabilities weaponized across cataloged threat campaigns.

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

  1. Isolate affected endpoints from the network immediately to sever unauthorized communications.
  2. Identify active malicious processes and capture volatile system memory for forensic analysis.
  3. Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services.
  4. Deploy updated endpoint detection signatures and verify perimeter firewall rules.
  5. Re-image compromised systems using verified clean golden images.
⚠️ Critical Mistakes to Avoid:
  • Do not attempt manual file deletion while network connections remain active.
  • Do not restore from untested backups without verifying that the backup snapshot predates the intrusion.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

high

EMBER Samples: 8,417

Executive Summary

The "High" classification is a generic risk severity indicator utilized by heuristic antivirus engines and thr...

View Profile & Rules →

moderate

EMBER Samples: 1,146

Executive Summary

The "Moderate" classification is a generic risk indicator employed by security software and threat intelligenc...

View Profile & Rules →

Complete Directory (2 Families)

Alphabetical index of all tracked malware families cataloged under generic detection threats: