Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

Three weeks after a system administrator resigns from an organization, a database server executing a scheduled midnight payroll job unexpectedly wipes all stored tables. Forensic review of the application's source code identifies an unauthorized script configured to monitor Active Directory for the former administrator's account status. Upon detecting that the account was flagged as disabled, the script automatically triggered the destructive payload. Which of the following malware types best describes this malicious code?

  1. Logic bombCevap
  2. B
    Ransomware
  3. C
    Worm
  4. D
    Trojan

Cevap

Logic bomb
The described malicious script functions as a logic bomb because it remained dormant within the application code until a specific logical trigger occurred—specifically, detecting that the former employee's Active Directory account had been marked as disabled.

Adım Adım Çözüm

1
Analyze the incident trigger and execution behavior described in the scenario.
The malicious payload executed only after a predefined system condition occurred (Active Directory account status changing to disabled).
Determining whether code execution is event-triggered, user-initiated, or self-propagating isolates the specific malware classification.
2
Map the execution behavior to official malware definitions.
Dormant code that executes a destructive payload upon meeting specified logical criteria is defined as a logic bomb.
Logic bombs lie undetected until conditional triggers—such as system dates, user logins, or account modifications—evaluate to true.

Anahtar Kavram

Logic Bomb Characteristics and Execution Triggers
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru