Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A threat hunting team analyzes workstation artifacts following reports of compromised privileged account credentials. Network telemetry and host activity reveal an unauthorized background program that captures input typed into authentication forms and periodically exfiltrates this data to an external server over port 443. The software was installed after an employee executed a third-party utility download, does not attempt to scan or self-replicate across local subnet subnets, and does not modify kernel-level system routines. Which of the following malware classifications best describes this threat?

  1. SpywareAnswer
  2. B
    Worm
  3. C
    Ransomware
  4. D
    Rootkit

Answer

Spyware (specifically keylogging functionality) is the malware classification that covertly monitors user activity, collects credentials, and exfiltrates input data.
Spyware is designed to run covertly on a device to record user activities, capture sensitive credentials or keystrokes, and exfiltrate the collected telemetry to an external command-and-control server.

Step-by-Step Solution

1
Analyze the observed malware behaviors and telemetry indicators in the scenario.
The malware captures user keystrokes/authentication input and transmits the gathered data to an external server via port 443.
Identifying the primary function (data collection and exfiltration) narrows down the malware family.
2
Evaluate the propagation mechanism and operational footprint.
The malware relies on user execution of a downloaded utility and lacks automated self-replication capabilities.
This rules out self-propagating threats like network worms.
3
Compare against malware taxonomy classifications.
Malware that covertly monitors and exfiltrates user input without altering kernel hooks or encrypting files is classified as spyware.
Spyware targets user data and activities while remaining passive to avoid detection.

Key Concept

Spyware and Keylogger Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic