Which description of a retrospective malware detection is true?

Wireshark is a packet capture tool used for real-time or recorded traffic analysis, not a retrospective malware detection platform.

Retrospective detection uses stored historical data - such as past network logs, file activity records, or updated threat intelligence - to identify hosts or files that were compromised by malware that may not have been detected at the time of infection. This approach is used by platforms like Cisco AMP when a file's disposition changes from unknown to malicious after new intelligence is received.

A network analyzer identifies traffic patterns in real time or from captures but does not perform the historical threat-intelligence correlation that defines retrospective detection.

Wireshark can capture packets but cannot correlate historical threat intelligence to retroactively identify malware-affected hosts or files.