Academy
TermMalware type

Worm

Malware that spreads by copying itself to other systems without user interaction.

Flow

  1. 1Finds targets
  2. 2Copies itself
  3. 3Repeats
Related families
—
MITRE ATT&CK
T1210 · Exploitation of Remote Services
Sources
6 sources
01

Overview

NIST defines a worm as a self-running program that can spread copies of itself to other systems over a network. Unlike a virus, it does not need a host file. NIST CSRC

Worms spread using vulnerabilities in network services, shared folders, removable drives or email address books. MITRE ATT&CK

02

How it works

  1. 1

    Finds targets

    It scans other devices on the network or contacts in the address book. MITRE ATT&CK

  2. 2

    Copies itself

    It transfers itself through a vulnerability, a share or a removable drive. MITRE ATT&CK

  3. 3

    Repeats

    The newly infected system starts the same cycle. MITRE ATT&CK

03

How to detect it

  • Connection attempts from one device to many internal addresses within a short time. MITRE ATT&CK
04

What to do

  • Apply security updates on time. MITRE ATT&CK
  • Segment the network; limit internal traffic to the services needed. MITRE ATT&CK
05

MITRE ATT&CK

T1210Exploitation of Remote ServicesT1091Replication Through Removable MediaT1046Network Service Discovery
06

Related terms

Terms

Lateral movementZero-dayRemote Access Trojan
07

Sources

  1. 1Exploitation of Remote Services (T1210) · MITRE ATT&CK
  2. 2Replication Through Removable Media (T1091) · MITRE ATT&CK
  3. 3Network Service Discovery (T1046) · MITRE ATT&CK
  4. 4Worm — glossary definition · NIST CSRC
  5. 5Update Software (M1051) · MITRE ATT&CK
  6. 6Filter Network Traffic (M1037) · MITRE ATT&CK