Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or telemetry profile on the right.

  • RootkitHost kernel telemetry revealing unlinked System Service Descriptor Table (SSDT) entries and hidden process IDs omitted from OS API enumerations.
  • Logic BombAn unauthorized scheduled script executing a payload only when a designated administrator account is disabled in directory services.
  • Fileless MalwareSystem event logs showing a trusted system utility executing base64-encoded commands directly in volatile memory via WMI.
  • Remote Access Trojan (RAT)Endpoint alerts indicating a disguised administrative tool maintaining an outbound encrypted C2 tunnel to an external IP address.

Answer

Rootkit pairs with kernel telemetry showing SSDT modifications; Logic Bomb pairs with the script triggered by user account status changes; Fileless Malware pairs with in-memory execution via WMI; Remote Access Trojan pairs with disguised utility establishing outbound C2 communication.
Rootkit matches kernel-level SSDT modification and API evasion. Logic Bomb matches the conditional trigger tied to user account changes. Fileless Malware matches memory-only WMI/PowerShell execution. Remote Access Trojan matches the disguised utility creating outbound C2 traffic.

Step-by-Step Solution

1
Examine stealth and kernel-level manipulation telemetry.
Link SSDT modifications and hidden process enumeration to Rootkit functionality.
Rootkits focus on stealth by hooking API routines and altering operating system kernel structures.
2
Analyze event-driven payload execution triggers.
Match account disability conditions to Logic Bomb behavior.
Logic bombs remain inactive until predefined logical or temporal conditions occur.
3
Analyze non-persistent, memory-only execution signatures using native tools.
Match WMI and memory-only command execution to Fileless Malware.
Fileless malware avoids traditional file-based detection by executing code within RAM via trusted binaries.
4
Examine backdoor capabilities hidden within legitimate-looking software.
Match disguised utility establishing external C2 tunnels to Remote Access Trojan (RAT).
RATs provide full operational control to attackers via covert outbound channels while pretending to be harmless applications.

Key Concept

Malware Classifications and Telemetry Artifacts
Estimated Time:1m 30s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic