Soru

Zorluk: ZorMalware Types and Indicators of Compromise

A security analyst is reviewing telemetry logs and incident report artifacts following a series of network anomalies. Match each observed technical telemetry artifact on the left with its corresponding malware classification on the right.

  • Execution of obfuscated PowerShell scripts pulling payloads directly into host RAM via WMI repository subscriptions without creating disk binariesFileless Malware
  • Modification of the Volume Boot Record (VBR) to execute malicious code prior to operating system kernel initializationBootkit
  • A database trigger configured to execute a destructive SQL script automatically when a specific user ID is purged from the HR databaseLogic Bomb
  • An unexpected outbound C2 encrypted session established by svchost.exe spawned directly as a child process of winword.exeRemote Access Trojan (RAT)

Cevap

Execution of PowerShell via WMI matches Fileless Malware; VBR modification matches Bootkit; HR database deletion trigger matches Logic Bomb; Word spawning svchost for C2 matches Remote Access Trojan (RAT).
Each telemetry artifact distinctly maps to its underlying malware mechanism: in-memory execution via system binaries matches fileless malware; boot sector modification prior to OS load matches bootkit persistence; event-triggered malicious payloads represent logic bombs; and process tree anomalies establishing remote command channels indicate Remote Access Trojans.

Adım Adım Çözüm

1
Analyze memory and file system artifacts
In-memory execution of obfuscated scripts via native tools (WMI/PowerShell) indicates Fileless Malware.
Fileless malware avoids traditional disk-based detection by operating exclusively in volatile memory.
2
Evaluate boot sequence persistence mechanisms
Pre-boot code execution altering the Volume Boot Record indicates a Bootkit.
Bootkits target the storage system's boot sectors to gain control before operating system security controls initiate.
3
Examine event-driven triggers
Code scheduled to run upon HR database user purging matches a Logic Bomb.
Logic bombs lie dormant until specific environmental conditions or administrative events execute the payload.
4
Analyze process tree lineage and network behavior
Productivity software spawning system host processes that initiate outbound command-and-control traffic matches a Remote Access Trojan (RAT).
RATs typically leverage process hollowing or malicious process spawn techniques to conceal C2 communications.

Anahtar Kavram

Malware Telemetry and Indicator Classification
Tahmini Süre:2m 0s
Bu soruyu puanla