Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

An enterprise security analyst investigates a workstation after an employee reports unexpected system sluggishness. Detailed inspection of system logs reveals a persistent background process hook intercepting API keystrokes and capturing authentication session cookies. Further analysis of network flow records demonstrates stealthy, recurring outbound connections over non-standard ports transferring the collected data to an external address, while no attempts to scan or infect adjacent hosts are detected. Which of the following malware types and indicators of compromise are demonstrated in this incident? (Select TWO.)

  1. Spyware and keylogging functionality intercepting sensitive user input and credential dataAnswer
  2. Command-and-control exfiltration evidenced by anomalous outbound network connectionsAnswer
  3. C
    Self-propagating worm mechanisms actively probing network shares to replicate across the subnet
  4. D
    Host-based buffer overflow vulnerability mitigated primarily through perimeter firewall ingress port blocking

Answer

The correct options are Spyware and keylogging functionality intercepting sensitive user input and credential data, and Command-and-control exfiltration evidenced by anomalous outbound network connections.
The scenario highlights two distinct indicators: local host API hooking to capture credentials (characteristic of spyware and keyloggers) and unauthorized outbound traffic transferring stole data to an external recipient (characteristic of command-and-control exfiltration).

Step-by-Step Solution

1
Analyze host process indicators
Process hooking keyboard input APIs and stealing cookies indicates active spyware/keylogger malware.
Spyware covertly monitors user activities and gathers sensitive personal or authentication data.
2
Analyze network traffic indicators
Unusual outbound data transfers over non-standard ports to an external IP indicate covert exfiltration over a command-and-control channel.
Indicators of Compromise (IoCs) for C2 traffic frequently involve unauthorized outbound network flows carrying stolen data.
3
Evaluate distractor propagation and mitigation options
Rule out worm mechanisms due to lack of replication, and rule out firewall controls for host memory flaws.
Differentiating malware propagation types and selecting valid technical controls prevents misdiagnoses during incident triage.

Key Concept

Malware Indicators of Compromise and Spyware/C2 Telemetry Analysis
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic