Windows

Mark of the Web (MOTW) is a Windows security mechanism that tags files downloaded from the internet to enforce additional protections such as warnings and restricted execution. This SECMONS glossary entry explains how MOTW works, why it matters in real-world exploitation, and how bypasses increase risk.

Ryuk is a targeted ransomware strain publicly associated with high-impact enterprise intrusions, often deployed following credential theft and lateral movement. This SECMONS profile provides structured analysis of Ryuk’s operational patterns, ecosystem relationships, and defensive implications.

TrickBot is a modular malware platform initially developed as a banking trojan and later expanded into a flexible intrusion framework used for credential theft, lateral movement, and ransomware staging. This SECMONS profile provides structured technical and operational analysis.

Emotet is a modular malware platform that evolved from a banking trojan into a large-scale loader and botnet ecosystem, frequently used to deliver additional payloads including ransomware. This SECMONS profile provides structured analysis of Emotet’s capabilities, targeting patterns, and defensive implications.