Static detection is security scanning that identifies threats by examining a file or artifact before it runs. It relies on fixed clues such as hashes, signatures, metadata, strings, packer patterns, or known malicious code fragments. Antivirus engines, email gateways, and file reputation systems often use this approach because it is fast and scalable.
It matters because static checks are strongest when a threat arrives as a complete, inspectable file. In campaigns where payloads are assembled in memory or built inside the browser, the final malicious binary may never appear on disk in a stable form. That reduces the value of hash blocking and signature matching, forcing defenders to use behavior-based tools, sandboxing, and memory-aware endpoint detection instead. Static detection is still useful for known malware and quick triage, but it is weaker against obfuscation, packing, polymorphism, and fileless techniques.