Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

During a post-incident analysis of an unexpected enterprise database outage, incident responders discover dormant malicious SQL routines embedded within a core payroll application stored procedure. Telemetry reveals that the script continuously queries the human resources database to verify whether a specific administrator account remains marked as active. The code contains logic specifying that if the account status changes to inactive, or if a designated calendar date passes, the routine automatically executes commands to purge database logs and overwrite primary table records. Which of the following malware types is described in this scenario?

  1. Logic bombAnswer
  2. B
    Worm
  3. C
    Trojan
  4. D
    Rootkit

Answer

Logic bomb
The correct answer is Logic bomb. A logic bomb is malicious code deliberately inserted into a software system that remains dormant until specific conditions are met, such as a date/time threshold, an employee termination event, or a database query output. In this scenario, checking the HR database status flag and trigger dates matches the classic IoCs of a logic bomb.

Step-by-Step Solution

1
Analyze the technical indicators of compromise described in the scenario
Identified dormant code embedded inside a legitimate stored procedure that checks for specific system conditions (account status flag and date threshold).
Understanding the execution mechanism is critical to categorizing malware types.
2
Evaluate the trigger condition and payload behavior
The malicious payload executes automatically only when specific logical criteria are fulfilled.
Code that waits for predefined logical or temporal conditions before executing a malicious payload defines a logic bomb.
3
Differentiate from alternative malware classifications
The threat does not self-replicate over a network (worm), hide as a benign application installer (Trojan), or subvert OS kernel functions to maintain stealth (rootkit).
Proper classification requires eliminating mechanisms that do not match the observed IoCs.

Key Concept

Logic Bomb Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic