Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A security monitoring system triggers an alert after Microsoft Word spawns a hidden PowerShell process executing an encoded command. Forensic inspection of the host system indicates that no traditional executable files were written to disk; instead, malicious code resides and executes entirely within volatile memory to maintain an outbound command-and-control session. Which of the following malware types is described in this incident?

  1. A
    Self-propagating worm
  2. B
    Kernel-level rootkit
  3. Fileless malwareAnswer
  4. D
    Standalone logic bomb

Answer

Fileless malware relies on living-off-the-land techniques and memory-only execution through existing system tools like PowerShell.
Fileless malware operates directly within system memory (RAM) and often uses native system processes or scripts (such as PowerShell or WMI) to perform malicious activities without dropping an executable file onto the local file system. This technique bypasses traditional signature-based antivirus solutions that scan disk files.

Step-by-Step Solution

1
Analyze host indicators
Observed Microsoft Word invoking a hidden PowerShell process with encoded arguments.
Identify the vector and process relationships on the endpoint.
2
Evaluate disk versus memory telemetry
No binary file artifact was created on the disk; payload runs entirely in volatile RAM.
Determine the artifact footprint to categorize execution behavior.
3
Map execution characteristics to malware taxonomy
Executing directly within system memory using native administrative scripts defines fileless malware.
Match telemetry indicators with standard threat definitions.

Key Concept

Fileless Malware Execution and Telemetry
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic