A hotel endpoint agent carries a signature for one malware family and a model that scores unusual parent-child process chains. Why does the agent keep both instead of relying on only one?
Select an answer to reveal the explanation.
Short Explanation
A photo on the wall catches people you already know, and a guard who watches how they move catches a familiar face doing something new. The hotel agent keeps a signature and a behavior model so known files and odd parent-child chains are both covered. Don't treat the model as a reason to skip review, and don't expect a file signature to read encrypted web traffic.
Full Explanation
The signature side matches a malware family the vendor has already described, often by a hash or a byte pattern. The model side scores relationships such as a strange parent spawning an unexpected child, which will not be on the hash list until someone publishes it. The agent keeps both because they cover different evidence. Signatures catch known files, and the model scores parent-child behavior the hash list misses. Treating the score as a final ruling is the wrong use of the model. The behavior model replaces investigation, so a parent-child alert can be closed with no further review. It overstates what a score can do. The ancestry, the command line, and the ticket still have to be checked. Endpoint signatures are also the wrong tool for traffic on the wire. Endpoint file signatures inspect the encrypted HTTPS body as it crosses the hotel network. It assigns them a network job they do not have. The body is encrypted in transit, and these signatures inspect files and patterns on the host. Flow storage is a third mismatch. The host firewall stores NetFlow records for every guest laptop that joins the hotel network. It confuses a local allow-or-deny decision with exported flow summaries, which that firewall does not keep. Exam caveat: a behavior model is noisier than a hash match and can flag an admin tool, so it adds coverage rather than retiring review. Operational check: open one parent-child alert, confirm the child hash is absent from the signature set, and still read the process ancestry before closing it.