Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

During an enterprise incident response triage, security engineers analyze a compromised domain controller demonstrating unauthorized administrative activity. Diagnostics reveal that the attack payload was injected directly into system RAM using a legitimate administrative utility, executing strictly in volatile memory without writing any standalone binary file to the host hard drive. Which of the following malware classifications best describes this type of threat?

  1. Fileless malwareAnswer
  2. B
    Self-propagating worm
  3. C
    Trojan horse
  4. D
    Logic bomb

Answer

Fileless malware
Fileless malware executes directly within volatile system memory (RAM) or piggybacks on legitimate host tools (such as PowerShell or WMI) without writing binary files to the storage drive, making traditional signature-based disk scans ineffective.

Step-by-Step Solution

1
Analyze the technical indicators provided in the incident log scenario.
Identified that the payload resides and executes strictly within system volatile RAM and leaves no standalone binary artifacts on disk.
Understanding the persistence and storage medium helps classify the malware category.
2
Compare observed Indicators of Compromise (IoCs) against standard malware taxonomy definitions.
Malware that operates entirely in memory or leverages native system tools without leaving traditional file footprint matches the fileless malware classification.
Fileless attacks evade standard disk-based anti-virus signatures by avoiding traditional executable writes.

Key Concept

Fileless Malware Execution and Volatile Memory Indicators
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic