During an incident response triage, a SOC analyst reviews EDR telemetry and network logs from an endpoint suspected of compromise. The logs indicate that a compromised account spawned a PowerShell process executing base64-encoded commands directly in host RAM without writing any binary payload to the local file system. Simultaneously, the endpoint initiated a high volume of outbound DNS TXT requests containing high-entropy subdomains to an unknown external domain. Which of the following technical indicators of compromise (IoCs) specifically characterize this fileless malware attack operating via Living-off-the-Land (LotL) techniques? (Select TWO.)
- In-memory execution and API memory allocations without creating physical PE binary files on the diskCevap
- Covert command-and-control (C2) communications utilizing high-entropy DNS TXT tunneling requestsCevap
- CCreation of an executable file dropped into the system temporary directory that self-replicates across SMB network shares
- DImplementation of inbound network firewall rules blocking TCP port 443 to prevent local process memory injection
Cevap
The correct indicators are in-memory execution without physical file creation on disk and covert command-and-control communications via DNS TXT tunneling requests.
Fileless malware leverages legitimate system tools like PowerShell to execute malicious logic in memory without writing files to disk, avoiding file system detection. Concurrently, attackers use DNS TXT tunneling as a covert channel to bypass standard perimeter security by embedding C2 traffic within standard DNS lookups.
Adım Adım Çözüm
Anahtar Kavram
Fileless Malware and Indicators of Compromise (IoCs)
Tahmini Süre:2m 0s