1. The goal of an investigation
The purpose of a security investigation is not to prove that every unfamiliar item is dangerous. The goal is to gather enough reliable evidence to make a better decision.
A process name, an unfamiliar IP address, an unsigned file, or a reputation result can be useful evidence, but a single signal often does not tell the whole story.
Instead of asking “How do I remove this malware?”, start with “What is this item, what is it doing, and what evidence indicates whether it is legitimate or suspicious?”
2. Preserve useful evidence before changing anything
If the activity may be important, record the available evidence before blocking, disabling, deleting, or removing the item.
- Take a screenshot of the ProtectKit finding when useful.
- Record the exact file or executable path.
- Record the process, service, or startup-entry name.
- Record publisher and digital-signature information.
- Record the SHA-256 hash when available.
- Record relevant remote addresses, domains, ports, and timestamps.
- Preserve relevant ProtectKit logs or exported reports.
If you may need to understand what happened later, deleting an item immediately can remove information that would have helped explain its behavior.
3. A practical ProtectKit investigation workflow
Identify exactly what you are investigating
Determine whether the finding involves a file, process, service, startup entry, network connection, security setting, device, or another system component.
Check identity and origin
Review the name, path, publisher, signature, hash, and any available metadata.
Check persistence
Determine whether the item starts automatically, runs as a Windows service, or otherwise attempts to remain active.
Check behavior
Review what the item is doing, including relevant system changes and network activity.
Check external context
Use optional reputation, registration, or other investigation services when they can add useful information.
Correlate the evidence
Look for several independent signals that support or contradict the same conclusion.
Choose the least destructive appropriate response
When possible, prefer a reversible or evidence-preserving response until you are confident that stronger action is justified.
4. Identify the item precisely
Names alone can be misleading. Legitimate and malicious software can use similar-looking names. Focus on the exact item.
Process or file name
Useful as a starting point, but not enough by itself.
Executable path
Shows where the program is actually running from and can provide important context.
SHA-256 hash
Identifies the exact file content much more precisely than the filename.
Associated software
Consider whether the file belongs to an application, driver, utility, or device software you intentionally installed.
5. Check the publisher and digital signature
A valid digital signature can provide useful evidence about who signed an executable and whether the signed file has been altered since signing. It is an important signal, but it is not an absolute guarantee of safety.
An unsigned file is also not automatically malicious. Many legitimate utilities and smaller applications are unsigned.
Ask:
- Is the file signed?
- Who is the signer or publisher?
- Does the publisher match the software you expected?
- Is the signature information consistent with the file's claimed identity?
- Are other signals consistent with legitimate software from that publisher?
6. Examine the file location
Where an executable runs from can add context. Windows system components, installed applications, temporary files, user-profile folders, and unusual writable directories have different purposes.
A location should never be evaluated in isolation. Legitimate software can use user-writable folders, and malicious software can attempt to place itself in locations that appear legitimate.
An unexpected path becomes more meaningful when it is combined with an unknown publisher, unusual persistence, suspicious behavior, or unexplained network activity.
7. Check startup programs and Windows services
Persistence means software has a way to start again after Windows starts, a user signs in, or another trigger occurs. Persistence is common in legitimate software, but it is also relevant during security investigations.
ProtectKit's Startup Programs and Services pages can help you determine whether the item or related software is configured to run automatically.
Before disabling a service or startup entry, determine what it belongs to. Disabling a legitimate Windows or application component can cause software or system functionality to stop working correctly.
8. Examine associated network activity
ProtectKit's Live Connections tools can help connect network activity with the process responsible for it.
Useful network evidence can include:
- The process making the connection.
- The remote IP address or destination.
- Local and remote ports.
- Protocol and connection state.
- Whether the destination is expected for the application.
- Whether the connection appears repeatedly.
- Available registration or reputation information.
Internet communication is normal for browsers, cloud software, update services, security products, messaging applications, and many other legitimate programs. A network connection becomes more significant when the surrounding evidence is also unusual.
9. Use reputation checks as evidence, not a verdict
ProtectKit may provide access to optional online reputation or investigation services. These can add valuable context, particularly when investigating a file hash, IP address, or domain.
Reputation systems can still produce incomplete information, false positives, false negatives, or no result at all. New or uncommon files may have little reputation history.
Likewise, one weak or isolated detection does not automatically prove a file is malicious. Evaluate the quality and consistency of the available evidence.
10. Correlate evidence instead of counting warnings
The strongest investigations connect related events and observations. Several independent signals that tell the same story are generally more meaningful than one isolated anomaly.
For example, an unfamiliar executable becomes more concerning if it also appeared unexpectedly, runs from an unusual location, lacks a recognizable publisher, creates persistence, accesses sensitive information, and then establishes unexplained outbound connections.
Conversely, an unfamiliar process may become less concerning when it is correctly signed by the expected software vendor, runs from the expected installation directory, has behavior consistent with that application, and communicates with infrastructure that makes sense for its purpose.
11. Decide what to do based on the evidence
After gathering evidence, choose a response proportional to the level of confidence and potential risk.
- Likely legitimate: No destructive action may be necessary. Keep the evidence if the item initially caused concern.
- Still unknown: Continue investigating. Avoid treating uncertainty as proof of safety or proof of malware.
- Suspicious: Consider limiting exposure while preserving evidence and gathering more context.
- Strong evidence of malicious activity: Use appropriate Windows security and recovery procedures, preserve important evidence when necessary, and consider professional assistance for serious incidents.
If a response could delete evidence, interrupt Windows, break an application, or remove access to important data, understand the consequences before proceeding.
12. When to seek additional help
Consider professional security assistance when an investigation involves possible account compromise, widespread ransomware activity, theft of sensitive information, persistent unauthorized access, business-critical systems, legal evidence, or a situation where preserving forensic evidence is important.
For questions about what ProtectKit itself is reporting, suspected false positives, or problems using an investigation feature, contact ProtectKit Support.
See what happened. Understand the evidence. Measure confidence. Then decide what to do next.