A security analyst is reviewing telemetry logs and incident report artifacts following a series of network anomalies. Match each observed technical telemetry artifact on the left with its corresponding malware classification on the right.
- Execution of obfuscated PowerShell scripts pulling payloads directly into host RAM via WMI repository subscriptions without creating disk binariesFileless Malware
- Modification of the Volume Boot Record (VBR) to execute malicious code prior to operating system kernel initializationBootkit
- A database trigger configured to execute a destructive SQL script automatically when a specific user ID is purged from the HR databaseLogic Bomb
- An unexpected outbound C2 encrypted session established by svchost.exe spawned directly as a child process of winword.exeRemote Access Trojan (RAT)
Cevap
Execution of PowerShell via WMI matches Fileless Malware; VBR modification matches Bootkit; HR database deletion trigger matches Logic Bomb; Word spawning svchost for C2 matches Remote Access Trojan (RAT).
Each telemetry artifact distinctly maps to its underlying malware mechanism: in-memory execution via system binaries matches fileless malware; boot sector modification prior to OS load matches bootkit persistence; event-triggered malicious payloads represent logic bombs; and process tree anomalies establishing remote command channels indicate Remote Access Trojans.
Adım Adım Çözüm
Anahtar Kavram
Malware Telemetry and Indicator Classification
Tahmini Süre:2m 0s