System telemetry and forensic logs from four compromised endpoints within an enterprise environment reveal distinct technical indicators of compromise (IoCs). Match each observed technical indicator on the left with its correct malware classification on the right.
- An automated database trigger configured to execute a destructive `DROP TABLE` command if a specific payroll user ID remains inactive in the user directory for 30 consecutive days.Logic Bomb
- An unpatched server generating widespread lateral SMB scan traffic across adjacent subnets and autonomously executing remote exploit payloads on vulnerable endpoints without credential access or human intervention.Network Worm
- An obfuscated PowerShell script retrieved directly from a persistent registry binary blob and executed strictly inside legitimate system memory (`svchost.exe`) without staging binary files to disk.Memory-Resident Payload
- A customized system driver executing at privilege level Ring 0 that alters Direct Kernel Object Manipulation (DKOM) structures to suppress specific running process IDs from Task Manager and system auditing utilities.Kernel Rootkit
Answer
The database trigger condition matches Logic Bomb; autonomous network SMB scanning matches Network Worm; script execution from registry to memory matches Memory-Resident Payload; kernel driver manipulation of process structures matches Kernel Rootkit.
Each indicator uniquely aligns with key malware behaviors: time/event triggers correspond to logic bombs; automated subnet propagation corresponds to worms; in-memory non-disk script execution corresponds to memory-resident payloads; and kernel-level object manipulation (DKOM) to mask processes corresponds to rootkits.
Step-by-Step Solution
Key Concept
Malware Types and Technical Indicators of Compromise
Estimated Time:2m 0s