Malware monitoring and detection

Abstract

Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file.