Spyware, malware analysis and MITRE ATT&CK: connecting evidence to behavior
Learn what spyware and malware analysis mean, and how MITRE ATT&CK helps organize observed adversary behavior.
## What is spyware?
**Spyware** is malicious software that secretly collects information about a user, device or organization and makes it available to an unauthorized party. Depending on its capabilities, it may collect browsing activity, messages or credentials. Spyware describes a collection purpose; it is not a synonym for every Trojan or remote-access tool. A Trojan describes deceptive presentation, and one program can fit more than one category. [NIST's spyware glossary](https://csrc.nist.gov/glossary/term/spyware) describes it as a type of malicious code that secretly gathers information.
## What is malware analysis?
**Malware analysis** is the examination of suspicious software to understand its behavior, capabilities and potential impact. Static analysis examines an artifact without executing it, for example by inspecting file metadata, embedded strings and code. Dynamic analysis observes behavior while it runs in a controlled environment, such as process activity and attempted network connections. Neither method guarantees a complete picture: a sample may hide behavior, wait for particular conditions, or detect an analysis environment. Analysis of untrusted files needs an appropriately isolated environment and an incident-handling process; do not run them on a production workstation. [NIST SP 800-83 Rev. 1](https://csrc.nist.gov/pubs/sp/800/83/r1/final) discusses malware incident prevention and handling for desktops and laptops.
## What is MITRE ATT&CK?
**MITRE ATT&CK** is a knowledge base that organizes observed adversary behavior. A tactic describes an adversary's goal—the why—while a technique describes a way to pursue it, and a sub-technique gives a more specific behavior. A procedure is a particular observed implementation. The matrix is a way to navigate these relationships, not a mandatory sequence of steps or a guarantee that every adversary uses every listed technique. [MITRE's getting-started guide](https://attack.mitre.org/resources/) and [FAQ](https://attack.mitre.org/resources/faq/) define these distinctions.
## Connect evidence to a defensive response
An analyst investigating suspected spyware might first preserve the original file and collect relevant logs according to the organization's evidence procedures. Static and controlled dynamic examination can then produce observations, such as a process reading browser data or attempting a network connection. Map an observation to an ATT&CK technique only when its evidence supports the behavior described; an outbound connection alone does not establish spyware, the actor's identity, or the full intent. Use the mapping to compare telemetry coverage and improve detections, and document uncertainty and gaps.