Attackers rarely send a file called malware.exe. They rename it, bury the real extension, or wrap it in something harmless, so a filename alone proves nothing.
The NetWitness hunting method checks three things on every file: the name, the claim, and the proof. Rename payload.exe to photo.jpg and the proof still reads as an executable. That mismatch is your lead. This cheat sheet shows how to find it across SMB, email, HTTP, and FTP.
What’s Inside
- Name, claim, and proof. The three checks NetWitness runs on every file, and how comparing claim to proof exposes a disguise.
- Where to start and what to catch. First hunts by direction, plus ten disguise patterns with confidence levels that set your pace.
- A worked example. An invoice that isn’t, traced from a user report to a confirmed Windows executable, plus the look-alikes to rule out.