Generally speaking, there are certain types of things that just shouldn’t be in legitimate files. One example might be the string “ping 8.8.8.8”, another might simply be the word “keylogger”. If they don’t belong in legitimate files, they may be good items for generic detection rules.


What words or content serves as a “red flag” that a file might be malicious? Or phrased differently, what type of content “doesn’t belong” in legitimate files? This is always fun to brainstorm, so throw down some ideas in the discussion thread below!


