Question

Difficulty: MediumMalware Types and Indicators of Compromise

Match each observed security incident technical indicator on the left with its corresponding malware classification on the right.

  • A scheduled task executing an obfuscated script creates an unauthorized persistent administrator account.Trojan
  • Direct Kernel Object Manipulation (DKOM) modifies active operating system data structures to conceal running processes.Rootkit
  • Automated network sweeps over TCP port 445 exploit SMB vulnerabilities to self-replicate payload code to adjacent hosts.Worm
  • A dormant script executes a malicious routine only when a target enterprise database table exceeds 100,000 records.Logic Bomb

Answer

The scheduled task creating persistent access matches Trojan; kernel memory manipulation to hide processes matches Rootkit; automated port 445 network propagation matches Worm; and environmental trigger execution matches Logic Bomb.
Each indicator aligns with a distinct technical behavior: kernel cloaking via DKOM signifies a Rootkit; autonomous network scanning and SMB exploitation signifies a Worm; pre-configured conditional triggering signifies a Logic Bomb; and hidden persistence via routine operating system utilities signifies a Trojan.

Step-by-Step Solution

1
Analyze item 1 regarding scheduled task obfuscated scripts creating unauthorized accounts.
Identified as a Trojan.
Trojans masquerade as or leverage legitimate functionality to secretly introduce unauthorized capabilities.
2
Analyze item 2 regarding Direct Kernel Object Manipulation (DKOM).
Identified as a Rootkit.
Rootkits operate at kernel privilege levels to alter system structures and mask processes.
3
Analyze item 3 regarding port 445 scanning and self-replication.
Identified as a Worm.
Worms propagate autonomously across network vulnerabilities without requiring user action.
4
Analyze item 4 regarding execution dependent on database record thresholds.
Identified as a Logic Bomb.
Logic bombs trigger malicious execution based on specific operational or logical events.

Key Concept

Distinguishing technical indicators of compromise across fundamental malware classifications.
Rate this question