Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

A security technician is analyzing a compromised workstation log after an administrative staff member manually ran an executable disguised as a printer driver update. Forensic analysis reveals that upon execution, the payload established persistence via Windows Task Scheduler to maintain access across reboots and initiated command-and-control traffic. The telemetry confirms the file did not perform automated network vulnerability scans or attempt self-replication to other network hosts. Which of the following malware characteristics and operational indicators are demonstrated in this scenario? (Select TWO.)

  1. Trojan classification based on masquerading as authorized software to induce user executionCevap
  2. Host-based persistence created via OS task scheduling mechanismsCevap
  3. C
    Worm behavior characterized by autonomous self-replication across open network shares
  4. D
    Mitigation reliant exclusively on network port blocking without removing endpoint artifacts

Cevap

The scenario demonstrates Trojan classification based on masquerading as authorized software to induce user execution, as well as host-based persistence created via OS task scheduling mechanisms.
The scenario highlights two key operational indicators: first, the executable disguised itself as a legitimate driver update to induce a user to launch it, which defines Trojan malware. Second, endpoint forensic logs show scheduled task creation, which is a key indicator of compromise establishing host persistence.

Adım Adım Çözüm

1
Analyze the initial execution vector described in the host telemetry.
The payload relied on disguising itself as a legitimate printer driver update requiring manual user execution, matching Trojan delivery.
Trojans hide inside seemingly legitimate software to trick users into executing malicious code.
2
Examine the endpoint persistence behavior.
The malware configured Windows Task Scheduler to maintain execution rights across reboots.
Scheduled task creation is a standard indicator of compromise used to establish persistent execution.
3
Evaluate negative telemetry indicators (lack of self-replication and scanning).
The file is confirmed not to be a worm because it lacks autonomous self-propagation capabilities.
Differentiating worms from Trojans requires identifying self-replication functionality.

Anahtar Kavram

Malware Types and Indicators of Compromise
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru