Examkin

Question

Difficulty: EasyMalware Types and Indicators of Compromise

During a security investigation on a compromised server, an administrator suspects a rootkit has been installed to maintain stealthy persistence. Which TWO of the following indicators of compromise specifically signal the presence of a rootkit?

  1. Discrepancies between low-level kernel queries and user-space administrative process listingsAnswer
  2. Interception and modification of system calls to conceal specific files and active network connectionsAnswer
  3. C
    Autonomous network scanning traffic targeting vulnerable SMB services across adjacent subnets
  4. D
    Configuration of host firewall rules to restrict inbound ICMP request traffic

Answer

The correct indicators of a rootkit are discrepancies between low-level kernel queries and user-space process listings, as well as the interception and modification of system calls to conceal files and network connections.
Rootkits achieve stealth by replacing or modifying operating system components and hooking system call interfaces. This creates discrepancies between raw kernel state and user-space management utilities, hiding malicious files, processes, and active network connections from administrators.

Step-by-Step Solution

1
Analyze the core operating behavior of a rootkit
Rootkits focus on stealth and persistent access by modifying OS system routines or kernel tables.
Understanding rootkit design helps identify how their indicators differ from standard user-mode malware.
2
Evaluate system call and process listing telemetry
Because rootkits hook OS system calls, native reporting tools display sanitized outputs that contradict direct kernel memory queries.
This discrepancy directly identifies rootkit concealment activities.

Key Concept

Rootkit Indicators of Compromise and Kernel-Level Concealment
Estimated Time:1m 0s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic