> For the complete documentation index, see [llms.txt](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/guide/basic-dynamic-analysis/host-indicators.md). # Host Indicators ## What are host indicators? The host indicators are the operations that the malware is doing on the host while it is running, it includes files manipulation, persistency mechanisms and everything that affects the host itself. For the host indicators, we will be using `Procmon` tool that tracks everything the malware does on the host. ## What indicators we are looking for?

Category	Examples / Description
File Operations	Creating, deleting, or modifying files, including dropped payloads in `%TEMP%`, `%APPDATA%`, hidden paths, or startup folders. Tampering with legitimate executables or system files such as `hosts`.
User Operations	Keylogging, clipboard monitoring, or screenshot capture. Simulating user actions or interacting with UI elements to harvest credentials.
Shell / Command Execution	Executing CMD, PowerShell, WMIC, or LOLBins (`certutil`, `mshta`, `rundll32`). Running encoded, obfuscated, or unusually-spawned shell commands.
Registry Modifications	Editing persistence keys (`Run`, Services) or changing security and Defender settings. Tampering with associations or adding keys for escalation or evasion.
Process Activity	Suspicious process creation or abnormal parent-child chains (e.g., Word → PowerShell). Injection, hollowing, unpacking, or spikes in CPU/RAM usage.
Services and Drivers	Installing or modifying services for persistence or elevated execution. Dropping or loading malicious kernel drivers or altering service configs.
Persistence Mechanisms	Creating scheduled tasks, WMI triggers, autoruns, or startup items. Using hidden or disguised persistence across multiple subsystems.
Network Configuration Changes	Altering DNS servers, firewall rules, or proxy settings. Modifying routes or network parameters to redirect or hide traffic.
System Configuration Changes	Changing policies, permissions, or disabling security tools. Removing shadow copies or modifying logging to reduce visibility.
Credential Access Activity	Accessing LSASS memory or dumping SAM/SECURITY hives. Loading credential-theft tooling or scraping clipboard credentials.
Anti-Analysis & Evasion	Detecting VMs, sandboxes, or debuggers using timing or artifact checks. Disabling or tampering with analysis and security tools.
IPC Behavior	Creating mutexes, named pipes, or shared memory for coordination. Using custom or covert IPC channels for internal communication.
Kernel-Level Manipulation	Hooking SSDT or modifying kernel callbacks. Hiding processes/drivers or altering kernel memory structures to evade detection.

## How to obtain host indicators? As these indicators varies so much, check the [Case Study](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/case-study/) to have full site about what is the process, generally here are 4 steps to be done 1. Have your `Procmon` ready and running. 2. Set the appropriate filters. 3. Run the malware. 4. Observe the result on `Procmon` and track the sequence of actions it does