Examkin

Question

Difficulty: HardMalware Types and Indicators of Compromise

During an incident response investigation on a compromised domain controller, a security team suspects the persistent presence of a rootkit alongside other malicious artifacts. Which of the following technical indicators of compromise (IoCs) specifically confirm the presence of a rootkit on the host? (Select TWO.)

  1. Hooked system call table pointers diverting kernel API requests to mask running malicious process IDsAnswer
  2. B
    Self-propagating payload sweeps across port 445 attempting automated SMB exploitation on adjacent subnets
  3. Direct Kernel Object Manipulation (DKOM) modifying active data structures to conceal open network socketsAnswer
  4. D
    Deployment of network-level stateful firewalls blocking unauthorized inbound command-and-control channels

Answer

The correct indicators confirming the presence of a rootkit are hooked system call table pointers diverting kernel API requests and Direct Kernel Object Manipulation (DKOM) modifying active data structures to conceal open network sockets.
Rootkits operate at deep operating system levels (often within kernel space) to maintain persistent, invisible control over a host. Intercepting API calls via system call table hooking and modifying kernel memory through Direct Kernel Object Manipulation (DKOM) allow the rootkit to bypass administrative detection tools and mask running processes and active sockets.

Step-by-Step Solution

1
Analyze the core operational mechanism of rootkit malware
Identify that rootkits aim to conceal malicious activity by operating at the kernel or system driver level
Rootkits modify lower-level operating system structures to stealthily hide processes, files, network connections, and privileges from administrative discovery tools.
2
Evaluate the technical telemetry presented in each indicator
System call hooking and Direct Kernel Object Manipulation (DKOM) directly match kernel-level evasion techniques utilized by rootkits
By intercepting system calls and modifying kernel memory structures directly, rootkits prevent native tools from displaying malicious artifacts.
3
Differentiate rootkit telemetry from worm propagation and perimeter defenses
Automated network SMB sweeps represent worm behavior, while firewall configurations are security controls rather than compromise indicators
Rootkits are defined by stealth and kernel manipulation rather than network self-replication mechanisms or defensive policy settings.

Key Concept

Kernel-Level Evasion and Rootkit Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic