A method, comprising: receiving, by a device, a malicious file; provoking, by the device and based on receiving the malicious file, a network activity reaction when operating the malicious file in a testing environment; determining, by the device and based on provoking the network activity reaction, a network activity profile associated with the malicious file, the network activity profile including information regarding at least one of: one or more requested network addresses, quantities of packets sent or received, distributions of packets sent or received, one or more ports that are opened for communication, or one or more ports that are utilized for communication; wherein determining the network activity profile associated with the malicious file comprises: receiving a trigger to determine whether one or more malicious files are operating on one or more client devices ; analyzing the malicious file to determine a set of malicious files similar to the malicious file; and determining the behavior associated with each of the files in the set of malicious files similar to the malicious file; determining, by the device, whether network activity for the one or more client devices corresponds to the network activity profile; determining, by the device, that the one or more client devices are infected with the malicious file based on the network activity having a threshold similarity to the network activity profile; and causing, by the device and based on determining that the one or more client devices are infected with the malicious file, a remediation action to be performed on the one or more client devices . receiving, by a device, a malicious file; provoking, by the device and based on receiving the malicious file, a network activity reaction when operating the malicious file in a testing environment; determining, by the device and based on provoking the network activity reaction, a network activity profile associated with the malicious file, the network activity profile including information regarding at least one of: one or more requested network addresses, quantities of packets sent or received, distributions of packets sent or received, one or more ports that are opened for communication, or one or more ports that are utilized for communication; one or more requested network addresses, quantities of packets sent or received, distributions of packets sent or received, one or more ports that are opened for communication, or one or more ports that are utilized for communication; wherein determining the network activity profile associated with the malicious file comprises: receiving a trigger to determine whether one or more malicious files are operating on one or more client devices ; analyzing the malicious file to determine a set of malicious files similar to the malicious file; and determining the behavior associated with each of the files in the set of malicious files similar to the malicious file; receiving a trigger to determine whether one or more malicious files are operating on one or more client devices ; analyzing the malicious file to determine a set of malicious files similar to the malicious file; and determining the behavior associated with each of the files in the set of malicious files similar to the malicious file; determining, by the device, whether network activity for the one or more client devices corresponds to the network activity profile; determining, by the device, that the one or more client devices are infected with the malicious file based on the network activity having a threshold similarity to the network activity profile; and causing, by the device and based on determining that the one or more client devices are infected with the malicious file, a remediation action to be performed on the one or more client devices . <EOS>