Abstract: Techniques and configurations for data management are described. Features may be extracted from backup data stored in a data management system for a target object, where the backup data may reflect the target object at a point-in-time. An anomaly associated with the target object may be detected based on the features extracted from the backup data. Based on detecting the anomaly, a malware identity associated with the anomaly may be identified based on the features extracted from the backup data. The identified malware identity may be indicated via a user interface.