Examkin

Soru

Zorluk: Çok zorMalware Types and Indicators of Compromise

A security analyst investigates an Endpoint Detection and Response (EDR) alert on an enterprise application server. Volatile memory triage reveals DLL function pointer hooking in system memory without corresponding binary files on disk, alongside a WMI event subscription executing an obfuscated PowerShell payload. Which of the following malware behaviors and indicators of compromise are characteristic of this specific incident? (Select TWO.)

  1. Fileless malware execution utilizing living-off-the-land binaries (LotL) for payload deliveryCevap
  2. Persistence established via OS management repository storage rather than traditional file system drop locationsCevap
  3. C
    Autonomous self-propagation across local subnets using automated SMB vulnerability exploitation vectors
  4. D
    Modification of kernel-mode host firewall filtering tables to suppress network detection alerts

Cevap

The attack exhibits fileless execution utilizing living-off-the-land binaries and establishes persistence via OS management repository storage (WMI) rather than traditional file system drop locations.
The scenario describes fileless malware that resides exclusively in volatile memory (RAM) and uses built-in administrative tools like PowerShell (living-off-the-land binaries) to execute commands. Persistence is achieved through WMI event subscriptions stored directly inside the system's management repository, avoiding standard disk file creation.

Adım Adım Çözüm

1
Analyze volatile memory artifacts and process indicators
DLL function pointer hooking occurring in RAM without accompanying disk binaries indicates a fileless/memory-only injection attack using system administrative processes (PowerShell).
Fileless malware executes directly in memory, leaving minimal traditional file-system artifacts and abusing native system binaries (LotL).
2
Evaluate the persistence mechanism
A WMI event subscription executes payloads directly via repository objects, eliminating the need to write standalone binary files to disk startup folders or standard registry run keys.
WMI repository persistence allows malicious code to trigger automatically while hiding outside traditional file monitoring paths.
3
Differentiate from worm and network filtering misconceptions
Self-propagating worms rely on automated network scanning/exploitation, while host firewall filtering relates to network access control configuration rather than host memory injection.
Targeted memory injection and WMI persistence represent distinct host-level stealth techniques rather than network propagation worms or firewall configuration changes.

Anahtar Kavram

Fileless Malware and Living-off-the-Land (LotL) Persistence via WMI
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru