Interview question
You have recovered a suspicious executable from an executive's laptop during a live incident. A colleague suggests uploading it to VirusTotal. What do you say?
An operational security question that catches a lot of otherwise strong candidates. The instinct to upload is exactly the instinct being tested.
What a strong answer covers
- Recognises that public uploads are visible to others, including the adversary.
- Identifies the specific risk: if the intrusion is targeted, uploading tells the actor they have been discovered and starts their clock.
- Notes that a targeted sample may itself contain victim-identifying data — hard-coded hostnames, domains, credentials, document content.
- Distinguishes commodity from targeted: for widely distributed commodity malware the risk is low and the benefit real.
- Proposes safer alternatives: private or on-premise sandbox, hash lookup instead of upload, retrohunt through a vendor with confidentiality terms.
- Notes that a hash lookup is not risk-free either but is far lower risk than a file upload.
- Frames it as a decision with a stakeholder — incident lead or legal — rather than an analyst's unilateral call.
- Does not simply forbid it; weighs the intelligence value against the disclosure risk.
Expert answer
I would stop and treat it as a decision rather than a reflex, because uploading is irreversible.
The core risk is that public sandboxes and repositories are public. Uploaded samples are visible to other subscribers, and monitoring for your own tooling appearing in them is a routine adversary practice. If this intrusion is targeted, the upload tells the actor they have been found, and their reasonable next move is to burn infrastructure, escalate, or destroy evidence — while we are still scoping. We would have handed over the initiative for a convenience.
There is a second risk specific to targeted samples: the file itself may carry victim-identifying material. Hard-coded internal hostnames or domains, embedded credentials, a tailored lure document, or configuration naming the target. Uploading can disclose the fact and identity of the incident, which is a legal and contractual problem as well as an operational one.
The judgement depends on what we are looking at. If triage indicates widely distributed commodity malware — a known family, high prevalence, nothing tailored — the disclosure risk is minimal because the actor already knows their tooling is public, and the enrichment is genuinely useful. If there is any sign this was built for us, the answer is no.
What I would do instead. Start with a hash lookup rather than an upload — that tells us whether the sample is already known without contributing anything, though it is not entirely free, since a query on a rare hash is itself a weak signal. Detonate in our own isolated sandbox, or a commercial one with contractual confidentiality and private submission. If we need vendor help, go through a relationship with an NDA rather than a public portal.
And I would put the decision to the incident lead, with legal involved if there is any disclosure exposure. It is not an analyst's call to make alone mid-incident.
Mistakes that cost candidates points
- Uploading without considering that the adversary may be watching.
- Missing that the sample may contain victim-identifying data.
- Banning public sandboxes outright without distinguishing commodity from targeted.
- Not offering a practical alternative path to the same enrichment.
- Treating it as a purely technical decision with no stakeholder or legal dimension.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?
- An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK.
- You have one piece of evidence: a single IP address that a compromised host was beaconing to. Walk me through how you would develop this.
- Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against.
- What is F3EAD, and why do some CTI teams prefer it to the traditional intelligence cycle?