Examkin

Question

Difficulty: Very hardMalware Types and Indicators of Compromise

During a post-incident security review of a critical enterprise server, system logs indicate that disk-based malware scanners and host integrity checks reported zero altered binaries or suspicious files on the file system. However, memory analysis reveals unauthorized code executing during early system initialization, hijacking the Volume Boot Record (VBR) execution path before the core operating system kernel load and security controls initialize. Which malware classification is directly indicated by this persistence and execution behavior?

  1. BootkitAnswer
  2. B
    Logic Bomb
  3. C
    Remote Access Trojan
  4. D
    Self-Propagating Worm

Answer

Bootkit
A bootkit targets the early boot sequence (such as the MBR, VBR, or UEFI execution flow), granting execution control before the OS kernel and host security scanners load.

Step-by-Step Solution

1
Analyze host telemetry and file system scan results
Discovered that all disk binaries are intact and verified clean, ruling out standard user-mode file-based malware.
Host security controls report clean signatures across file system paths.
2
Examine memory triage and early boot logs
Identified unauthorized execution occurring at the VBR level prior to OS kernel initialization.
The payload gains control before operating system security mechanisms are active.
3
Map execution artifacts to malware taxonomy
Malware targeting the MBR/VBR/UEFI boot chain to achieve pre-boot persistence is defined as a Bootkit.
Bootkits specifically target pre-kernel startup procedures to bypass OS-level integrity checks.

Key Concept

Bootkit Malware and Pre-Boot Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic