Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

An incident response team investigates a workstation that consistently bypasses security controls during boot-up. Low-level forensic examination reveals that malicious code was injected directly into the device's Unified Extensible Firmware Interface (UEFI) storage, allowing the payload to execute before the operating system kernel and Endpoint Detection and Response (EDR) drivers initialize. Which of the following malware classifications best describes this threat?

  1. BootkitAnswer
  2. B
    Logic Bomb
  3. C
    Trojan
  4. D
    Worm

Answer

Bootkit is correct because it specifically targets pre-boot firmware/storage such as UEFI or MBR to execute before the operating system kernel and security agents load.
The correct option identifying the threat as a bootkit accurately reflects malware that infects system boot environments like the MBR, VBR, or UEFI NVRAM. This allows it to run before the OS kernel and security components load, effectively hiding its presence and maintaining high privilege persistence.

Step-by-Step Solution

1
Analyze the technical telemetry and IoCs in the scenario.
Identified malicious code residing in UEFI storage executing prior to OS kernel and EDR driver initialization.
Determines the specific execution timing and persistence layer of the threat.
2
Evaluate malware classifications against pre-boot execution characteristics.
Bootkits target boot code structures (MBR/VBR/UEFI) to run before the OS environment.
Distinguishes bootkits from OS-level malware like standard kernel rootkits or user-mode Trojans.

Key Concept

Bootkit Malware and Pre-Boot Persistence
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic