Foundational Four

Expanded Definition

The Foundational Four is a malware investigation lens, not a detection tool or a containment procedure. It helps analysts organise evidence across the four places malware most often leaves traces: file system activity, registry changes, memory artefacts, and network communication. The value of the model is that it reduces a sprawling host investigation into a manageable structure without assuming that every incident will expose itself in the same place.

Its boundaries matter. The framework is strongest for endpoint-centric investigations, especially ransomware, commodity malware, and hands-on intrusions where artefacts are scattered across persistence, execution, and command-and-control activity. It is weaker as a complete incident methodology because it does not by itself cover identity telemetry, cloud logs, SaaS events, or application-layer evidence. That is why practitioners usually treat it as an investigative scaffold rather than a full analytic standard.

The term is often misunderstood as implying that four artefact families are always sufficient. In practice, the model is a starting point for triage and hypothesis testing, and a responder may need to move beyond it when the event is fileless, memory-resident, or primarily network-driven.

Examples and Use Cases

In a ransomware investigation, file system review can reveal encrypted extensions, dropped executables, or staged payloads, while registry inspection may show persistence keys or modified run entries.

When malware is executed in-memory, responders often lean on process and memory artefacts to recover injected code, unpacked payloads, or signs of reflective loading that do not exist on disk.

Network evidence helps reconstruct beaconing, lateral movement, or exfiltration paths, especially when an intrusion blends ordinary traffic with malicious command traffic.

In a rapid triage workflow, the Foundational Four gives analysts a consistent checklist for deciding whether a host has only suspicious artefacts or a broader compromise footprint.

For threat hunting, the model supports a structured sweep across multiple telemetry sources so that a single weak signal in one area can be validated or discounted against the others.

Security Implications

The main security value of the Foundational Four is correlation. Malware rarely leaves only one kind of trace, and investigators who examine only a single area risk missing persistence, execution context, or evidence of remote control. A registry modification may look harmless until it is paired with a suspicious binary in the file system and outbound traffic to an unusual destination. Likewise, memory artefacts may prove that an apparently legitimate process is actually hosting injected code.

Misuse usually takes the form of overconfidence. If responders stop after checking disk artefacts, they can miss fileless malware. If they focus only on network logs, they can miss a dormant implant with no current beaconing. If they rely only on memory, they may lose the persistence story that explains how the compromise survives reboot.

The practical consequence is investigative blind spots. Those blind spots increase dwell time, weaken scoping decisions, and can lead to incomplete eradication because the responder identifies the symptom but not the mechanism that sustains it.

Domain and Governance Relevance

The Foundational Four matters because it standardises how responders think about host compromise across common evidence classes. That makes it useful in SOC playbooks, malware analysis workflows, and incident response training where teams need a repeatable way to pivot from one clue to the next. The model also creates a shared vocabulary between detection engineers and incident handlers, which reduces ambiguity when a case is handed off.

Its governance value is mostly operational rather than regulatory. Organisations that use it well are better able to define what telemetry must be retained, which artefact sources must be available to responders, and where investigative gaps exist. The framework is not an endpoint in itself, but it supports disciplined investigation when time pressure and partial evidence would otherwise encourage guesswork.

For NHIMG’s identity security audience, the term is relevant only indirectly: if a compromised host also exposes credentials, tokens, or privileged sessions, the Foundational Four can help surface the initial malware path, but it does not replace identity-focused investigation of who or what those artefacts can reach.

Related resources from NHI Mgmt Group

• How should teams respond when a foundational cryptographic library has multiple patched versions?
• What breaks when organisations treat the last four digits of an SSN as a safe authenticator?
• What breaks when AI governance is treated as four separate checklists instead of one control architecture?
• How should cloud teams enforce AWS Foundational Security Best Practices across Infrastructure as Code?