Examkin

Question

Difficulty: Very hardMalware Types and Indicators of Compromise

A SOC analyst responds to an alert regarding anomalous outbound network connections from a critical enterprise server. During incident triage, the analyst gathers the following telemetry artifacts:

- Volatile memory inspection shows shellcode executing directly within the allocated memory space of a legitimate `lsass.exe` process via reflective DLL injection.
- System logs indicate persistence was achieved via a non-standard WMI event consumer executing an encoded script payload.
- Comprehensive storage forensics confirm no new binary files, modified system executables, or untrusted drivers exist on disk.

Which of the following malware classifications best describes this attack vector?

  1. Fileless malwareAnswer
  2. B
    Trojan
  3. C
    Kernel-level rootkit
  4. D
    Logic bomb

Answer

Fileless malware
Fileless malware operates entirely within volatile system memory (RAM) or uses built-in administrative framework tools (such as WMI and PowerShell) without dropping traditional executable files onto disk. The presence of reflective DLL injection in `lsass.exe` alongside WMI persistence and zero file system artifacts explicitly defines a fileless compromise.

Step-by-Step Solution

1
Analyze file system artifacts
Confirm no suspicious binaries or modified files exist on disk storage.
Eliminates traditional malware types that require standalone executable files on disk.
2
Analyze volatile memory and process injection indicators
Identify shellcode running inside legitimate system memory (`lsass.exe`) via reflective DLL injection.
Demonstrates memory-only execution that bypasses standard disk signature scanning.
3
Evaluate persistence mechanism and attack classification
WMI event subscription and encoded scripts execute directly in memory/living-off-the-land context.
Confirms the incident fits the definition of fileless malware.

Key Concept

Fileless malware and Living-off-the-Land (LotL) execution techniques
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic