A security analyst is reviewing endpoint telemetry and forensic artifacts across several compromised systems. Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or behavior on the right.
- Kernel-Mode RootkitModifies the System Service Descriptor Table (SSDT) to conceal running processes and open ports from system monitoring APIs.
- Fileless MalwareExecutes malicious code directly within volatile RAM by injecting payload into `lsass.exe` using `VirtualAllocEx` without creating local disk artifacts.
- Logic BombRemains dormant on an enterprise host until a database event triggers an unauthorized script that deletes key audit logs.
- User-Space KeyloggerRegisters an API hook using `SetWindowsHookEx` with `WH_KEYBOARD_LL` to capture raw input events across active applications.
Cevap
Kernel-Mode Rootkit matches SSDT modification to hide processes; Fileless Malware matches executing payload directly in memory via VirtualAllocEx without disk artifacts; Logic Bomb matches dormant malicious script triggered by a specific event condition; User-Space Keylogger matches API hooking via SetWindowsHookEx with WH_KEYBOARD_LL.
Each malware classification is accurately paired with its distinct technical telemetry indicator: Kernel-mode rootkits manipulate kernel structures like SSDT; Fileless malware runs in memory using native process injection APIs without disk files; Logic bombs await specific logical condition triggers; Keyloggers register keyboard hooks like SetWindowsHookEx.
Adım Adım Çözüm
Anahtar Kavram
Identifying Malware Types via Technical Telemetry and Indicators of Compromise (IoCs)