A malware detection system and method

A malware detection method comprising:

• generating, by a processing circuitry, one or more create-load events, each generated upon determining at least one file being loaded or attempted to be loaded into a memory of an endpoint before a pre-determined period of time passing from creation of the file on the endpoint, each create-load event is associated with the respective file;
• determining, by the processing circuitry, utilizing one or more evidence scoring rules, a probability indicator for at least some of the create-load events, the probability indicator being indicative of a probability that the file associated with the respective create-load event comprises malicious code;
• and
• alerting, by the processing circuitry, a user of the malware detection system upon the probability indicator of at least one create-load event being above a threshold.

A non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code, executable by processing circuitry of a computer to perform a malware detection method, the malware detection method comprising:

• generating, by a processing circuitry, one or more create-load events, each generated upon determining at least one file being loaded or attempted to be loaded into a memory of an endpoint before a pre-determined period of time passing from creation of the file on the endpoint, each create-load event is associated with the respective file;
• determining, by the processing circuitry, utilizing one or more evidence scoring rules, a probability indicator for at least some of the create-load events, the probability indicator being indicative of a probability that the file associated with the respective create-load event comprises malicious code;
• and
• alerting, by the processing circuitry, a user of the malware detection system upon the probability indicator of at least one create-load event being above a threshold.