Question

Difficulty: HardMalware Types and Indicators of Compromise

System telemetry and forensic logs from four compromised endpoints within an enterprise environment reveal distinct technical indicators of compromise (IoCs). Match each observed technical indicator on the left with its correct malware classification on the right.

  • An automated database trigger configured to execute a destructive `DROP TABLE` command if a specific payroll user ID remains inactive in the user directory for 30 consecutive days.Logic Bomb
  • An unpatched server generating widespread lateral SMB scan traffic across adjacent subnets and autonomously executing remote exploit payloads on vulnerable endpoints without credential access or human intervention.Network Worm
  • An obfuscated PowerShell script retrieved directly from a persistent registry binary blob and executed strictly inside legitimate system memory (`svchost.exe`) without staging binary files to disk.Memory-Resident Payload
  • A customized system driver executing at privilege level Ring 0 that alters Direct Kernel Object Manipulation (DKOM) structures to suppress specific running process IDs from Task Manager and system auditing utilities.Kernel Rootkit

Answer

The database trigger condition matches Logic Bomb; autonomous network SMB scanning matches Network Worm; script execution from registry to memory matches Memory-Resident Payload; kernel driver manipulation of process structures matches Kernel Rootkit.
Each indicator uniquely aligns with key malware behaviors: time/event triggers correspond to logic bombs; automated subnet propagation corresponds to worms; in-memory non-disk script execution corresponds to memory-resident payloads; and kernel-level object manipulation (DKOM) to mask processes corresponds to rootkits.

Step-by-Step Solution

1
Analyze the condition-based database trigger indicator.
Identified a dormant malicious script tied to user account status.
Code designed to initiate destructive actions upon specific logical triggers is classified as a logic bomb.
2
Analyze autonomous subnet scanning and SMB payload delivery.
Identified self-propagating network behavior without user interaction.
Malware capable of autonomous replication across network services is classified as a network worm.
3
Analyze in-memory execution via PowerShell and registry binary storage.
Identified complete avoidance of physical binary file storage on host disks.
Malware executing directly within volatile memory and using non-standard file system locations to avoid disk detection is memory-resident/fileless malware.
4
Analyze kernel-level modification (Ring 0 / DKOM) suppressing process visibility.
Identified low-level operating system hooks designed to mask malicious processes from administrative tools.
Software operating with kernel privileges to conceal system artifacts and maintain root access is classified as a rootkit.

Key Concept

Malware Types and Technical Indicators of Compromise
Estimated Time:2m 0s
Rate this question