Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

During an incident response investigation, a SOC analyst examines endpoint detection telemetry from a workstation alerting on suspected fileless malware execution involving process injection. Which of the following technical indicators of compromise (IoCs) specifically indicate that memory-only process injection using legitimate system binaries has occurred? (Select TWO.)

  1. A legitimate system process such as powershell.exe executing with base64-encoded command-line arguments to reflectively load payload code into RAMAnswer
  2. An injected native host process such as lsass.exe establishing unexpected outbound network connections on non-standard remote portsAnswer
  3. C
    A newly created standalone executable binary residing in the %TEMP% directory attempting self-propagation across local subnets via port 445
  4. D
    The deployment of a local host firewall block rule targeting inbound HTTP connections to protect against system web server vulnerabilities

Answer

The correct indicators are encoded PowerShell commands used to load payloads reflectively in RAM and native system processes (such as LSASS) initiating abnormal outbound network connections.
Fileless malware resides in volatile system memory and utilizes built-in tools (living-off-the-land) to avoid disk detection. Encoded PowerShell command lines executing reflective memory injection and trusted system processes initiating abnormal outbound network traffic are classic indicators of fileless process injection.

Step-by-Step Solution

1
Analyze process execution parameters and command-line arguments.
Identify base64-encoded PowerShell execution designed to bypass disk-based scanning by loading payloads directly into memory.
Fileless malware relies on living-off-the-land binaries (LotLBins) like PowerShell to execute code without creating new executable files on disk.
2
Evaluate network behavior relative to expected process baselines.
Detect abnormal outbound connections originating from injected legitimate processes.
Process injection targets trusted system binaries (such as LSASS or Explorer); when injected, the process inherits network privileges and generates anomalous network telemetry.

Key Concept

Fileless Malware and Process Injection Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic