10. Malware, Ransomware and Threat-Led Investigation

Introduction and Context

Malware investigation is a central capability in digital forensics and incident response because malicious software often provides both the mechanism and the evidence of compromise. A suspicious executable, script, document, browser extension, or memory-resident process may explain how an attacker entered an environment, what the attacker attempted to achieve, which systems were affected, and whether the threat remains active.

Modern investigations rarely involve a single, easily identifiable virus. Intrusions commonly combine legitimate administration tools, stolen credentials, scripts, cloud services, scheduled tasks, remote management protocols, and purpose-built malware. Ransomware operations illustrate this development particularly clearly. Encryption is often the final stage of a longer intrusion involving reconnaissance, privilege escalation, credential theft, lateral movement, data theft, and disruption of recovery systems.

A competent investigator must therefore do more than classify a file as malicious. The investigator must preserve evidence, determine functionality and intent, reconstruct an attack timeline, identify indicators of compromise, map behavior to an adversary model, assess business impact, and provide defensible recommendations. This chapter presents a threat-led approach that integrates static analysis, dynamic analysis, sandboxing, reverse-engineering fundamentals, threat intelligence, and the MITRE ATT&CK framework.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain major malware categories, infection mechanisms, persistence methods, and operational objectives.

2. Preserve suspicious files and associated evidence safely and forensically.

3. Perform foundational static and dynamic malware analysis without exposing production systems.

4. Interpret indicators such as hashes, domains, paths, mutexes, registry changes, and behavioral patterns.

5. Use sandboxing and reverse-engineering techniques to form and test analytical hypotheses.

6. Investigate ransomware as an intrusion campaign rather than merely an encryption event.

7. Apply threat intelligence and ATT&CK mapping to support detection, scoping, and response.

8. Evaluate technical, organizational, ethical, and legal issues in malware investigations.

Malware as an Investigative Object

Malware is software designed, adapted, or deployed to perform unauthorized or harmful actions. The classification is based on purpose and use, not only on code structure. A legitimate remote administration tool may become part of a malicious intrusion when operated with stolen credentials and an unauthorized objective. Conversely, some malicious programs are highly specialized and may perform only one stage of an attack.

Common categories include viruses, worms, trojans, spyware, keyloggers, rootkits, botnet agents, downloaders, loaders, information stealers, remote-access trojans, wipers, and ransomware. These categories overlap. A ransomware sample may include credential theft, command-and-control communication, anti-analysis features, and destructive routines. A loader may have little harmful functionality itself but may retrieve a second-stage payload.

Investigators should distinguish between four related properties:

• Capability: what the software can technically do.
• Execution: what the software actually did in the observed environment.
• Intent: the purpose inferred from code, context, and attacker behavior.
• Impact: the operational, financial, legal, or safety consequences.

This distinction prevents a common analytical error: assuming that every capability was exercised or that a file’s name accurately describes its purpose.

Important Terminology

An indicator of compromise (IOC) is an observable artifact associated with malicious activity, such as a cryptographic hash, domain, IP address, file path, registry key, email address, or mutex. An indicator of attack (IOA) describes behavior suggesting an attack, such as abnormal PowerShell execution, credential dumping, or mass file renaming. IOCs are often useful for retrospective searching, while IOAs can support earlier behavioral detection.

A dropper installs or releases another payload. A loader prepares or executes a payload, often in memory. A beacon is a periodic communication from an implant to an operator-controlled service. Command and control (C2) is the infrastructure and protocol used to communicate with compromised systems. Persistence is the ability to survive reboot, user logoff, or other interruptions. Living off the land refers to using legitimate tools already present on a system, such as PowerShell, WMI, scheduled tasks, or remote services.

A packer compresses or transforms executable code, often to reduce size or frustrate analysis. Obfuscation conceals code or configuration without necessarily encrypting the entire program. Anti-analysis includes debugger detection, virtual-machine checks, delayed execution, and misleading behavior. Fileless malware operates substantially through memory, scripts, registry data, or legitimate interpreters, although the term does not imply that no forensic artifacts exist.

The Malware Investigation Lifecycle

Malware investigation should be hypothesis-driven. The initial question is not simply “What is this file?” but “What event or activity does this artifact help explain?” A practical lifecycle consists of preservation, triage, characterization, controlled execution, correlation, scoping, and reporting.

Preservation and Evidence Handling

A suspicious sample should not be opened casually on an analyst’s workstation. The original must be preserved, hashed, and stored in a restricted evidence repository. Relevant associated material may include the email message, attachment metadata, download source, endpoint logs, memory capture, process tree, persistence locations, network records, and user reports.

Evidence handling should document who collected the item, when and where it was collected, how it was transferred, and what transformations were performed. A working copy should be used for analysis. Hashes such as SHA-256 provide integrity checks, although a hash alone does not establish that a sample is malicious or identify every related variant.

The investigator should record the analytical environment, tool versions, configuration, time zone, and network controls. Reproducibility is especially important when malware changes behavior according to operating-system version, locale, privileges, internet access, or elapsed time.

Triage

Triage determines priority and immediate risk. Questions include:

• Is the sample associated with an active incident?
• Is it executing on other systems?
• Does it appear to contact external infrastructure?
• Does it have destructive, credential-stealing, or propagation capability?
• Is the host business-critical or safety-relevant?

Triage may include file type identification, hash calculation, signature inspection, metadata review, string extraction, reputation checks, and endpoint telemetry. Reputation services can accelerate identification, but investigators must consider confidentiality, false positives, sample sharing, and the possibility that novel malware has no prior reputation.

Static Analysis: Learning from Code Without Execution

Static analysis examines a sample without running it. It is safer than execution and can reveal structure, dependencies, embedded resources, compiler characteristics, configuration, and likely functionality. Static analysis is not always sufficient: packed, encrypted, or heavily obfuscated programs may reveal little until execution or memory analysis is performed.

Initial examination should confirm the true file type rather than relying on the extension. Portable Executable metadata, section names, imported libraries, entry point information, digital signatures, resources, and compilation timestamps can provide useful clues. Timestamps must be treated cautiously because they may be forged, normalized, or affected by build systems.

Strings can reveal URLs, filenames, registry paths, command-line fragments, error messages, ransom notes, and encryption-related text. However, absence of readable strings is not evidence of benign behavior. Analysts may use string decoding, deobfuscation, and extraction of embedded configuration to improve visibility.

Import tables and API references are valuable but must be interpreted in context. References to functions associated with process creation, registry modification, network communication, service installation, or cryptography suggest capabilities, not necessarily execution. A malware family may resolve functions dynamically to conceal imports.

Static analysis also includes control-flow examination. Disassemblers and decompilers help analysts understand functions, branches, data structures, and relationships among routines. The output is an interpretation rather than original source code and may contain errors. Naming functions according to observed behavior and maintaining analytical notes are important reverse-engineering practices.

Reverse-Engineering Fundamentals

Reverse engineering begins with questions and hypotheses. An analyst may ask: Where is the configuration stored? How is the victim identifier generated? Which condition triggers encryption? What files are excluded? How does the program obtain a key? Which routine communicates with the operator?

A useful method is to identify the program entry point, trace initialization routines, locate suspicious constants and API calls, follow data passed to network or cryptographic functions, and compare static findings with runtime observations. Analysts should avoid changing the sample unnecessarily and should preserve unpacked or modified artifacts as derived evidence with clear provenance.

Cryptographic behavior deserves careful interpretation. The presence of a cryptographic library does not prove ransomware, because encryption may protect network communication or configuration. In ransomware, the investigator should determine whether encryption is applied to file contents, filenames, key material, or communication, and whether a distinct victim key or operator-controlled key is involved. The aim is to understand behavior, not to attempt unauthorized decryption or recovery of data.

Dynamic Analysis and Sandboxing

Dynamic analysis observes a sample while it executes in a controlled environment. It can reveal process creation, file modification, registry changes, persistence, network connections, memory allocation, privilege use, and interaction with security controls. A sandbox automates some of this observation, but sandbox results are not automatically complete or reliable.

A useful laboratory architecture separates the analysis network from production. Snapshots permit controlled restoration, while simulated services can capture DNS, HTTP, or other traffic without allowing uncontrolled communication. Analysts should disable shared folders, clipboard integration, unnecessary host access, and automatic sample synchronization. Network simulation must be designed carefully because malware may recognize fake services or alter behavior when internet access is absent.

Dynamic analysis commonly records:

• Process and thread creation, including parent-child relationships.
• File creation, deletion, renaming, and modification.
• Registry and service changes.
• Scheduled tasks, startup items, and authentication activity.
• DNS queries, connection attempts, protocols, and certificate details.
• Memory regions, injected code, and loaded modules.
• Security-tool interference and anti-analysis behavior.

A short execution window may miss delayed actions, scheduled persistence, user-triggered behavior, or command-driven functionality. Repeated runs under different privileges, operating-system versions, locales, and network conditions can expose conditional behavior. Nevertheless, repeated execution must not become uncontrolled experimentation. The sample should be contained, and the analyst should define stopping conditions before execution.

Interpreting Sandbox Results

A sandbox report is an observation record, not a final verdict. A connection to an IP address may be a test endpoint, a content-delivery service, or a malicious C2 server. A deleted file may reflect normal program cleanup or anti-forensic behavior. Analysts should correlate sandbox observations with endpoint telemetry, packet captures, memory, code, and external intelligence.

The most useful output is often a behavioral sequence: an attachment launches a script interpreter; the script retrieves a payload; the payload creates persistence; credentials are accessed; a remote service is used; archives are prepared; and file encryption begins. This sequence supports both incident reconstruction and detection engineering.

From Indicators to Adversary Behavior

Threat intelligence adds context to technical evidence. Strategic intelligence addresses motives and risks; operational intelligence concerns campaigns and infrastructure; tactical intelligence describes techniques and observable artifacts. Malware analysis primarily produces tactical evidence, but its value increases when connected to operational patterns and organizational risk.

Indicators should be normalized and enriched. A domain may be examined through registration history, passive DNS, certificate reuse, hosting relationships, and sightings in organizational telemetry. A file hash may identify an exact sample but fail to detect a modified variant. File paths, mutexes, command-line patterns, registry locations, and behavioral rules may be more resilient than hashes.

The MITRE ATT&CK framework provides a common language for describing adversary tactics and techniques. Tactics express goals such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Techniques describe how those goals are pursued. For example, malicious execution through PowerShell, scheduled-task persistence, credential dumping, remote services, and data encrypted for impact can be mapped to relevant ATT&CK techniques.

ATT&CK mapping should be evidence-based. An analyst should record the observation, the mapped technique, confidence, source, and any assumptions. Mapping a technique because a malware family is commonly associated with it is weaker than mapping it because logs, code, or memory show that it occurred. ATT&CK is not a complete attribution system and should not be used to claim that two incidents were conducted by the same actor merely because they share techniques.

Ransomware as a Campaign

Ransomware is malicious activity intended to deny access to data or systems, usually through encryption, while demanding payment or another concession. Contemporary ransomware incidents may include data theft, public disclosure threats, system destruction, harassment, and attacks against backups or virtualization platforms. The visible ransom note is therefore often the endpoint of a multi-stage intrusion.

Investigation should address at least five questions:

1. How did the adversary obtain initial access?

2. How long was the adversary present before encryption or disruption?

3. Which accounts, systems, data stores, and administrative tools were accessed?

4. Was data exfiltrated, destroyed, or merely encrypted?

5. Can the organization restore trustworthy operations without reinfection?

Immediate response must balance containment with evidence preservation. Isolating affected systems can limit spread, but abrupt shutdown may destroy volatile evidence. Decisions should consider the encryption process, safety and availability requirements, legal obligations, and the likelihood that the adversary still has active access.

Scoping should include identity systems, privileged accounts, remote-access infrastructure, endpoint telemetry, domain controllers, file servers, backup platforms, cloud services, hypervisors, and security-management systems. Investigators should search for precursor activity such as disabling security tools, deleting shadow copies, testing administrative access, creating accounts, compressing data, or using remote management utilities.

Recovery is not complete when files are restored. Organizations must understand the initial access vector, rotate credentials and keys, remove persistence, validate backup integrity, monitor for recurrence, and document decisions. Payment decisions involve legal, ethical, financial, and operational considerations and should be handled by authorized leadership with legal advice and appropriate authorities.

Applied Case: Illustrative Regional Health Network Incident

Background

A fictional regional health network operates hospitals, laboratories, and outpatient clinics. Early on a Monday morning, several file servers display a ransom note and begin rejecting ordinary user access. Some clinical workstations remain operational, but the electronic records platform is degraded.

Situation and Initial Analysis

The response team isolates affected network segments and preserves selected live systems for memory capture. Initial triage identifies a compromised remote-access account. Authentication logs show unusual access from an unfamiliar location three days earlier. Endpoint telemetry reveals PowerShell activity, creation of a scheduled task, use of a remote administration utility, and a burst of archive creation before encryption.

A recovered executable is analyzed in an isolated laboratory. Static analysis shows an encrypted configuration containing a C2 domain, a victim identifier, excluded directories, and a public-key cryptographic component. Dynamic analysis confirms that the sample enumerates network shares, terminates selected processes, deletes shadow copies, and renames files before encryption. The sample also attempts to contact a second domain that is not present in the organization’s initial threat-intelligence search.

ATT&CK and Scope Assessment

The team maps the evidence to valid ATT&CK techniques for external remote services, PowerShell execution, scheduled-task persistence, remote services, archive collection, command and control, and data encrypted for impact. The map is used to identify missing telemetry rather than to declare attribution.

Review of proxy and firewall records reveals outbound transfers to a cloud-storage service before encryption. The team cannot assume that all transferred data was sensitive, so it compares archive names, timestamps, file-access logs, and data-loss-prevention alerts. Domain-controller review identifies a privileged account used from a workstation that normally belongs to a contractor. The account is disabled, tokens are invalidated, and related credentials are rotated.

Response and Recovery

Backups are disconnected from affected administrative networks and tested in a clean recovery environment. Systems are rebuilt or restored in priority order after the initial access vector is closed. The organization deploys additional detection for suspicious remote logins, abnormal PowerShell, shadow-copy deletion, mass file renaming, and unusual archive transfers.

Outcome and Learning Points

Operations are restored without treating the ransom note as the complete explanation of the event. The investigation establishes that encryption was the final phase of a prolonged compromise and that data theft was a separate impact requiring notification assessment. The principal lessons are that identity telemetry is as important as malware telemetry, backups must be protected from administrative compromise, and ATT&CK mapping is most valuable when connected to concrete evidence and detection improvements.

Challenges, Risks, and Common Errors

Malware analysis is affected by time pressure, incomplete telemetry, anti-analysis features, variant diversity, and ambiguous evidence. Analysts may over-rely on commercial labels, treat a sandbox score as proof, or mistake a single IOC for a complete detection strategy. Another frequent error is analyzing only the malware sample while ignoring the compromised host and identity environment.

Attribution is particularly risky. Shared malware, rented infrastructure, copied code, and common criminal techniques can produce misleading similarities. Technical findings should be expressed with confidence levels and alternative explanations. Reports should distinguish observed facts, interpretations, assumptions, and unresolved questions.

Safety failures can expose the organization to reinfection or leak sensitive samples. Analysts must control outbound communication, protect patient, customer, or employee data, and avoid uploading confidential material to public services without authorization. Legal authority is required before examining systems outside the investigation’s approved scope.

Governance, Ethics, and Professional Practice

Malware investigations may involve personal data, privileged communications, health information, intellectual property, and evidence relevant to criminal proceedings. Collection should follow necessity, proportionality, authorization, retention, and access-control requirements. Chain-of-custody procedures and reproducible methods support defensibility.

Incident responders should coordinate with legal counsel, privacy officers, management, law enforcement, insurers, and affected business owners as appropriate. Public disclosure must avoid unnecessary exposure of victims and must satisfy applicable breach-reporting obligations. Analysts must not contact suspected adversaries, probe external systems, or attempt countermeasures without explicit legal and organizational authorization.

Automation, Analytics, and Emerging Practice

Security orchestration can automate hash searches, domain enrichment, endpoint isolation, credential-disablement workflows, and ATT&CK reporting. Detection systems increasingly combine endpoint, identity, network, cloud, and backup telemetry. Behavioral analytics can identify unusual administrative activity even when malware hashes change.

Machine learning can assist classification, clustering, anomaly detection, and prioritization, but it does not replace expert validation. Models may inherit biased training data, produce false positives, or fail against adversarially modified samples. Generative AI may help summarize reports or suggest investigative queries, but confidential evidence must not be entered into unapproved services, and every generated interpretation requires human verification.

Emerging threats include attacks on cloud control planes, identity-centric extortion, ransomware targeting virtualization infrastructure, supply-chain compromise, malware delivered through trusted software, and the increased use of signed or legitimate tools. These developments reinforce a central principle: resilient investigation depends on behavior, context, and cross-source correlation rather than on malware signatures alone.

Best Practices for Advanced Investigators

1. Preserve the original sample and calculate integrity hashes before analysis.

2. Use isolated, resettable laboratories with controlled networking.

3. Combine static, dynamic, memory, network, identity, and host analysis.

4. Treat reputation results and sandbox scores as supporting evidence, not conclusions.

5. Record hypotheses, observations, confidence, tools, and analytical limitations.

6. Search for related activity across users, endpoints, servers, cloud services, and backups.

7. Map only evidence-supported ATT&CK techniques and record the source of each mapping.

8. Distinguish capabilities from actions actually observed during the incident.

9. Protect sensitive samples and personal data throughout the investigation.

10. Convert findings into durable controls, detections, recovery improvements, and lessons learned.

Chapter Summary

Malware investigation combines forensic preservation, static examination, controlled execution, reverse engineering, threat intelligence, and incident reconstruction. Static analysis reveals structure and possible capabilities, while dynamic analysis shows how a sample behaves under defined conditions. Sandboxing accelerates observation but must be interpreted critically and correlated with host, memory, network, and identity evidence.

Ransomware should be investigated as a campaign rather than as an isolated encryption event. Scoping must address initial access, persistence, credential use, lateral movement, exfiltration, backup compromise, and recovery integrity. ATT&CK provides a useful behavioral vocabulary when mappings are based on evidence and expressed with appropriate confidence. Professional investigations also require safe laboratories, defensible documentation, legal authorization, privacy protection, and careful use of automation and AI.

Key Terms

Malware: Software designed, adapted, or used to perform unauthorized or harmful actions.

Ransomware: Malware or an intrusion operation intended to deny access to data or systems, commonly through encryption and extortion.

Indicator of Compromise (IOC): An observable artifact associated with malicious activity.

Indicator of Attack (IOA): A behavior suggesting that an attack is occurring or has occurred.

Loader: Software that prepares, retrieves, or executes another payload.

Persistence: The ability of malicious activity to survive interruption or restart.

Command and Control (C2): Infrastructure and communication used by an operator to control compromised systems.

Sandbox: An isolated environment used to execute and observe suspicious code.

Static Analysis: Examination of software without executing it.

Dynamic Analysis: Observation of software while it executes in a controlled environment.

Packer: A program or technique that compresses or transforms executable code.

Obfuscation: Concealment of code, data, or logic to hinder understanding or detection.

Reverse Engineering: Analysis of a compiled program to infer its structure and behavior.

Living off the Land: Use of legitimate tools already available in an environment for malicious purposes.

Threat Intelligence: Contextualized information about threats, adversaries, infrastructure, and behaviors.

MITRE ATT&CK: A knowledge base describing adversary tactics, techniques, and procedures.

Exfiltration: Unauthorized transfer of data from an environment.

Victim Identifier: A value used by malware or an operator to distinguish a compromised organization or system.

Chain of Custody: Documentation demonstrating how evidence was collected, handled, transferred, and preserved.

Review Questions

Short Answer Questions

1. Distinguish capability, execution, intent, and impact in malware investigation.

2. Why should a malware sample be analyzed from a working copy rather than the original?

3. What information can static analysis obtain from imports and strings?

4. Why is a ransomware incident investigated as a campaign?

5. What is the difference between an IOC and an IOA?

Long Answer Questions

1. Explain a defensible workflow for static and dynamic malware analysis, including laboratory safety and evidence preservation.

2. Discuss the strengths and limitations of sandboxing in professional incident response.

3. Explain how threat intelligence and ATT&CK mapping can improve malware investigation and detection engineering.

4. Describe the major investigative stages of a ransomware incident from initial access through recovery.

5. Discuss ethical, legal, privacy, and governance considerations in advanced malware investigations.

Analytical / Application Questions

1. A sample creates a scheduled task, launches PowerShell, contacts a domain, and then exits after five minutes. Design an investigation plan that distinguishes persistence, execution, and command-and-control evidence.

2. An organization has encrypted servers but no evidence yet of data theft. What logs, systems, and artifacts should investigators examine before reaching a conclusion?

3. A sandbox identifies a suspicious IP address, but endpoint logs show no corresponding connection. Propose plausible explanations and a method for resolving the discrepancy.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes an indicator of attack from an indicator of compromise?

A. An indicator of attack describes suspicious behavior, while an indicator of compromise is an observable artifact associated with malicious activity.

B. An indicator of attack is always a file hash, while an indicator of compromise is always a network address.

C. An indicator of attack is used only after recovery, while an indicator of compromise is used only during containment.

D. There is no practical distinction between the two terms.

Correct Answer: A. An indicator of attack describes suspicious behavior, while an indicator of compromise is an observable artifact associated with malicious activity.

Question 2

Why should a sandbox report not be treated as a final verdict?

A. Sandboxes cannot record file-system activity.

B. Observed behavior may be conditional, incomplete, or require correlation with other evidence.

C. Malware never changes behavior in a sandbox.

D. Sandbox reports contain only static information.

Correct Answer: B. Observed behavior may be conditional, incomplete, or require correlation with other evidence.

Question 3

Which finding most strongly suggests that a ransomware event involved pre-encryption intrusion activity?

A. A ransom note appears on one workstation.

B. A file has a nonstandard extension.

C. Logs show credential access, remote administration, archive creation, and shadow-copy deletion before encryption.

D. Several users report that files are unavailable.

Correct Answer: C. Logs show credential access, remote administration, archive creation, and shadow-copy deletion before encryption.

Question 4

What is the primary value of mapping observed activity to MITRE ATT&CK?

A. It proves the identity of the attacker.

B. It provides a common behavioral language for scoping, detection, and response.

C. It replaces the need for forensic evidence.

D. It identifies the exact malware source code.

Correct Answer: B. It provides a common behavioral language for scoping, detection, and response.

Question 5

Which practice best protects the integrity of a malware investigation?

A. Opening the original attachment on the analyst’s normal workstation.

B. Uploading every sample to a public service without authorization.

C. Hashing and preserving the original while conducting analysis on a documented working copy.

D. Changing the sample before calculating its hash.

Correct Answer: C. Hashing and preserving the original while conducting analysis on a documented working copy.

Question 6

An executable imports cryptographic functions. What is the most appropriate conclusion?

A. It is definitely ransomware.

B. It cannot communicate with a C2 server.

C. It has a possible cryptographic capability that requires contextual and behavioral analysis.

D. It must be benign because encryption is present.

Correct Answer: C. It has a possible cryptographic capability that requires contextual and behavioral analysis.

Question 7

Which evidence would be most useful for determining whether ransomware operators exfiltrated data before encryption?

A. The color of the ransom note.

B. Outbound transfer records correlated with archive creation, file access, and data-loss-prevention telemetry.

C. The sample’s filename alone.

D. The number of encrypted file extensions only.

Correct Answer: B. Outbound transfer records correlated with archive creation, file access, and data-loss-prevention telemetry.

Question 8

Why can a malware hash be an insufficient detection strategy?

A. Hashes cannot be calculated for executable files.

B. A modified variant can have a different hash while retaining similar behavior.

C. Hashes reveal the attacker’s motive automatically.

D. Hashes are useful only for network traffic.

Correct Answer: B. A modified variant can have a different hash while retaining similar behavior.

Question 9

Which action presents the greatest avoidable laboratory risk?

A. Using snapshots to restore an analysis virtual machine.

B. Simulating network services in an isolated environment.

C. Allowing unrestricted outbound connectivity and shared folders from the analysis machine.

D. Recording tool versions and environmental conditions.

Correct Answer: C. Allowing unrestricted outbound connectivity and shared folders from the analysis machine.

Question 10

A report states that a malware family is known to use credential dumping but provides no incident-specific evidence. What is the principal analytical weakness?

A. The report uses too many hashes.

B. The report confuses a possible capability or reputation with an observed action.

C. The report contains a timeline.

D. The report distinguishes facts from assumptions.

Correct Answer: B. The report confuses a possible capability or reputation with an observed action.