{
  "family": "high",
  "sample_count": 8417,
  "category": "generic_detection",
  "description": "<h3>Executive Summary</h3>\nThe \"High\" classification is a generic risk severity indicator utilized by heuristic antivirus engines and threat intelligence platforms. It is not a specific malware family, but rather a definitive flag indicating that an analyzed file or process exhibits behaviors fundamentally dangerous to the security and integrity of a system.\n\n<h3>Behavioral Context and Detection Mechanisms</h3>\nSecurity tools assign a \"High\" risk label when a file engages in activities that strongly correlate with destructive malware or advanced persistent threats (APTs), even if the file's static signature does not match a known database entry. Behaviors that trigger a \"High\" severity alert include:\n<ul>\n<li><strong>Ransomware Indicators:</strong> Rapid, mass encryption of files in user directories, or attempts to delete Volume Shadow Copies (`vssadmin.exe delete shadows`).</li>\n<li><strong>Privilege Escalation:</strong> Unauthorized attempts to exploit known local vulnerabilities (e.g., exploiting outdated drivers) to gain `SYSTEM` level access.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to terminate security processes, disable Windows Defender, or unhook user-mode APIs used by EDR solutions.</li>\n</ul>\n\n<h3>Risk Assessment and Incident Triage</h3>\nAn alert classified as \"High\" requires immediate, critical incident response. Unlike generic adware labels, a \"High\" detection indicates an active attempt to compromise the network, steal data, or cause significant operational disruption.\n\n<h3>Response and Eradication Strategy</h3>\n<ul>\n<li><strong>Immediate Containment:</strong> The endpoint triggering the \"High\" alert must be instantly severed from the corporate network, either physically or via network isolation features within the EDR platform, to halt lateral movement.</li>\n<li><strong>Forensic Capture:</strong> Capture a memory dump and disk image of the isolated endpoint for forensic analysis to determine the scope of the breach and identify the specific threat actor or malware family involved.</li>\n<li><strong>Threat Hunting:</strong> Utilize the behavioral indicators that triggered the alert (e.g., specific command-line arguments, dropped file paths) to conduct a proactive threat hunt across the entire enterprise environment.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HighRisk",
    "Risk.High",
    "Generic.High"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:03:45Z",
  "type": "Generic",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}