Malware Detected Notification - 恶意代码检测通知 —— 检测到病毒、木马或其它恶意代码时上报

Go back Parent node: Security Incident Notification - 安全事件通知子树 —— 认证失败、入侵、恶意代码与策略违规类事件，1-9 事件类、10-19 处置与关闭类、20-99 预留扩展 (1.3.6.1.4.1.59719.0.4)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.0.4.3`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) notifications(0) security-incident-notification(4) malware-detected-notification(3) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/Notifications/SecurityIncidentNotification/MalwareDetectedNotification`
WEID notation:	`weid:P-1A2V-0-4-3-9`
DER encoding:	`06:0B:2B:06:01:04:01:83:D2:47:00:04:03`

Description

English:
Malicious code detected notification. Reported when a virus, a trojan or other malicious code is detected.
Status: registered but unused. No device or platform has emitted this notification. Before first use, define the hash algorithm used to identify the sample and the quarantine action to be recorded. The unused state shall be re-verified at each revision of this file.
Recommendation: Carry the sample hash, the file path, the detection engine version and the action taken, and never transfer the sample itself inside the notification payload.
See also: 1.3.6.1.4.1.59719.0.4, 1.3.6.1.4.1.59719.6.5, 1.3.6.1.4.1.59719.0.4.10.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
恶意代码检测通知。检测到病毒、木马或其它恶意代码时上报。
状态：已注册但未使用。尚无设备或平台上报过本通知。首次使用前应定义样本标识所用的哈希算法以及需记录的隔离动作。本文件每次修订时须重新核验该未使用状态。
建议：应携带样本哈希、文件路径、检测引擎版本与已采取动作，且不得在通知载荷中传输样本本体。
关联节点：1.3.6.1.4.1.59719.0.4、1.3.6.1.4.1.59719.6.5、1.3.6.1.4.1.59719.0.4.10。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
No items available

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC2C8094F7 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-ef44155d9622	OIDplus Information Object Custom UUID (RFC 9562)
guid:87fb5501-07b6-3b6b-8b66-a198df5c46c1	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:7c03b1f4-2bf9-5d08-a5e0-a26fb1e2d575	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:D2-64-AC-80-94-F7	OIDplus Information Object MAC address, Unicast (AAI)
mac:D3-64-AC-80-94-F7	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-0-4-3-9	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=746624247	OIDplus Information Object X.500 DN