Malware

The malware plugin is a heuristic scaffold. It produces one high-severity finding when any event has category process_execution or file_write, or has one of the tags malware, ransomware, or trojan.

It expects generic records with category, source, and optional tags, actor, host, target, and action. A comma-separated tag string is split into tags during normalization.

The plugin does not scan files, evaluate YARA rules, inspect process command lines, or integrate with an endpoint vendor. Use it as a template for adding artifact hashes, YARA matches, parent/child process context, or reputation lookups while preserving the shared plugin contract.