Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A security analyst is reviewing endpoint telemetry and forensic evidence following a corporate incident. Match each observed technical Indicator of Compromise (IoC) on the left with its correct malware classification on the right.

  • A process executes a Base64-encoded command directly within volatile memory using PowerShell without dropping a binary file to disk, while establishing persistence via a WMI event subscription.Fileless Malware
  • System call table hooks are identified alongside Direct Kernel Object Manipulation (DKOM) that actively conceals listening network sockets and process IDs from process management utilities.Rootkit
  • Network logs show rapid automated probe traffic targeting TCP port 445 across multiple subnets, self-replicating to adjacent unpatched systems without requiring user interaction.Worm
  • An end user manually launches an executable disguised as a software update utility, which installs the expected application while silently deploying a covert remote access channel.Trojan

Answer

Fileless Malware pairs with in-memory PowerShell execution without disk binaries; Rootkit pairs with kernel-level DKOM and syscall table manipulation to hide processes; Worm pairs with automated network port scanning and self-replication across subnets; Trojan pairs with malicious software disguised as a legitimate setup utility requiring manual execution.
The correct pairings accurately reflect the core mechanisms and telemetry signatures of each malware category. Fileless malware operates purely in volatile memory via scripts or legitimate system utilities like PowerShell. Rootkits install deep within kernel architecture to hook system calls and alter operating system structures (DKOM) to hide artifacts. Worms leverage network service vulnerabilities (such as SMB port 445) to spread autonomously across connected devices. Trojans rely on user interaction, using trickery to conceal malicious functionality within legitimate-looking executable applications.

Step-by-Step Solution

1
Analyze the first telemetry artifact describing in-memory PowerShell execution and WMI event subscription persistence without disk write operations.
Identify this behavior as living-off-the-land techniques characteristic of fileless malware.
Fileless malware resides in volatile memory and leverages standard system tools to avoid detection by traditional file-based antivirus scanners.
2
Analyze the second telemetry artifact detailing DKOM and system call table hooking designed to conceal open network ports.
Identify this behavior as kernel-mode privilege manipulation characteristic of a rootkit.
Rootkits operate with ring 0 privileges to alter system telemetry and hide malicious activity from operating system diagnostics.
3
Analyze the third telemetry artifact showing automated SMB scanning and network propagation without user interaction.
Identify this behavior as autonomous network self-replication characteristic of a worm.
Worms operate independently across network links, taking advantage of vulnerabilities without needing human execution.
4
Analyze the fourth telemetry artifact describing a user executing a program disguised as a legitimate software update.
Identify this social engineering mechanism and hidden payload delivery as a Trojan.
Trojans rely on deceptive packaging to trick users into manually granting execution rights to embedded malicious software.

Key Concept

Malware Types and Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic