Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

An enterprise Endpoint Detection and Response (EDR) agent raises a high-severity security alert on a database server. Inspection reveals a legitimate Windows system process, `svchost.exe`, executing inline PowerShell commands using encoded arguments directly in system memory without writing any executable binaries to disk. System monitoring logs show scheduled tasks calling WMI repositories to maintain execution across system reboots. Which of the following malware classifications is demonstrated by these indicators of compromise?

  1. Fileless malwareCevap
  2. B
    Self-propagating worm
  3. C
    Rootkit
  4. D
    Trojan horse

Cevap

The telemetry describes fileless malware because it operates in volatile memory (RAM) utilizing legitimate system tools without dropping traditional malicious binaries onto the host disk storage.
Fileless malware relies on living-off-the-land techniques by hijacking legitimate system binaries (such as PowerShell and WMI) and running payloads directly inside volatile RAM memory, leaving no traditional payload file footprint on the filesystem disk.

Adım Adım Çözüm

1
Analyze execution mechanism telemetry
Identified PowerShell executing encoded payloads directly in volatile system memory.
Execution without writing files to local disk storage distinguishes non-traditional execution methods.
2
Evaluate persistence mechanism artifacts
Observed WMI repository calls and scheduled tasks triggering native processes.
Fileless malware leverages 'living-off-the-land' binaries (LotL) and native OS frameworks for persistence.
3
Classify the malware category
Correlated memory-resident execution and native tool misuse into fileless malware.
Combining RAM-only operations with native binary abuse matches the core technical definition of fileless attacks.

Anahtar Kavram

Fileless Malware and Living-off-the-Land (LotL) Execution
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru