Risk Heuristics

Risk Heuristics

These heuristics are implemented as of v0.4.0. hightower scan --all shows a risk verdict for every process, and hightower explain <name|pid> spells out which findings (if any) applied.

The disclaimer comes first

hightower is an educational aid, not an antivirus. Its heuristics are simple, public, and deliberately conservative. They produce false positives and false negatives. A suspicious verdict does not mean malware, and a trusted verdict does not guarantee safety.

hightower never tells you to kill or delete a system process. A verdict is a prompt to investigate, not a sentence.

The verdict model

Each process gets a ProcessVerdict with an overall RiskLevel:

• trusted -- recognized and in its expected place; nothing stood out.
• review -- nothing alarming, but something is worth a human glance.
• suspicious -- one or more strong warning signs.

The overall level is simply the worst finding raised by any rule (findings are ordered suspicious > review > trusted). Each finding carries a short, plain-language summary of why.

The rules

Each heuristic is a small RiskRule (the Strategy pattern). The classifier runs them all and aggregates the findings.

1. Path masquerading -- suspicious

A known Windows process name (e.g. svchost.exe, csrss.exe) running from outside its expected directory (%SystemRoot%\System32 or SysWOW64). This is a classic malware technique: copy a trusted name into a user folder to blend in. A real svchost.exe never runs from Downloads.

2. Unsigned or untrusted binary -- review/suspicious

The executable has no valid digital signature, or one that is present but not trusted (broken chain, self-signed, revoked). Legitimate software from a reputable vendor is almost always signed.

3. Unknown process -- review

A name absent from the known-process database with no recognized (trusted) signature. Reported as "unknown, review manually" -- never as a categorical "this is malware". Most third-party software is legitimately unknown to the curated database, so a trusted digital signature is enough to clear it.

A fourth heuristic -- flagging processes that run from Temp / Downloads / AppData -- is a planned refinement, not yet implemented.

Current limitations

• Signatures: only embedded Authenticode signatures are checked. Many Windows system binaries are catalog-signed and would read as unsigned, so the unsigned rule skips processes already in the known-process database.
• Publisher name is not extracted from the certificate yet, so the table shows a publisher only for known-database entries.
• The known-process database is small (a curated set of core Windows processes); expect many legitimate processes to be unknown until it grows. See how to contribute an entry.

What hightower will not do

• Claim certainty. It surfaces signals; you decide.
• Touch, kill, quarantine, or modify anything. It is read-only.
• Phone home. All checks are local; there is no network and no telemetry.