Examkin

Question

Difficulty: HardMalware Types and Indicators of Compromise

During an incident response investigation, a security analyst reviews an Endpoint Detection and Response (EDR) alert on a enterprise workstation. Telemetry logs show that a user opened a weaponized document that invoked PowerShell. The script executed directly within system memory, injected shellcode into a legitimate system process, established an encrypted reverse shell, and modified registry run keys for persistence without creating executable binary files on the local disk. Which of the following malware classifications best describes this threat?

  1. Fileless malwareAnswer
  2. B
    Self-propagating worm
  3. C
    Host-based rootkit
  4. D
    Logic bomb

Answer

Fileless malware
Fileless malware operates in volatile memory (RAM) and uses built-in administrative tools such as PowerShell or Command Prompt (living-off-the-land techniques). Because no malicious executable binaries are written to disk, traditional file-based antivirus solutions often fail to detect it.

Step-by-Step Solution

1
Analyze host log indicators and execution path
Identified PowerShell launching from a document macro and executing payload directly in system RAM.
Tracking the execution chain reveals how the initial access vector initiated code execution.
2
Evaluate disk activity and persistence mechanisms
No new executable files (.exe, .dll) were written to disk; persistence relies on registry keys calling built-in utilities.
Absence of traditional disk-based malicious binaries is the hallmark signature of fileless attacks.
3
Synthesize indicators to determine malware type
Memory-resident execution using native OS binaries (Living off the Land) classifies the attack as fileless malware.
Fileless threats leverage system tools (e.g., PowerShell, WMI) to operate inside RAM without dropping files.

Key Concept

Fileless Malware Telemetry and Indicators of Compromise
Estimated Time:1m 30s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic