Match each observed security incident technical indicator on the left with its corresponding malware classification on the right.
- A scheduled task executing an obfuscated script creates an unauthorized persistent administrator account.Trojan
- Direct Kernel Object Manipulation (DKOM) modifies active operating system data structures to conceal running processes.Rootkit
- Automated network sweeps over TCP port 445 exploit SMB vulnerabilities to self-replicate payload code to adjacent hosts.Worm
- A dormant script executes a malicious routine only when a target enterprise database table exceeds 100,000 records.Logic Bomb
Answer
The scheduled task creating persistent access matches Trojan; kernel memory manipulation to hide processes matches Rootkit; automated port 445 network propagation matches Worm; and environmental trigger execution matches Logic Bomb.
Each indicator aligns with a distinct technical behavior: kernel cloaking via DKOM signifies a Rootkit; autonomous network scanning and SMB exploitation signifies a Worm; pre-configured conditional triggering signifies a Logic Bomb; and hidden persistence via routine operating system utilities signifies a Trojan.
Step-by-Step Solution
Key Concept
Distinguishing technical indicators of compromise across fundamental malware classifications.