Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

Match each technical telemetry scenario with its corresponding malware classification based on the observed indicators of compromise.

  • PowerShell executing with `-EncodedCommand` and `-NoProfile` parameters, fetching payload instructions directly into volatile memory without writing binaries to local storage.Fileless Malware
  • Ring 0 kernel driver execution that modifies Direct Kernel Object Manipulation (DKOM) structures to hide process IDs and files from system management utilities.Rootkit
  • A database script scheduled to run a destructive query automatically 30 days after a specific employee account is set to inactive status in the directory.Logic Bomb
  • Automated network telemetry showing a workstation self-propagating across port 445 to adjacent subnets without requiring human interaction.Worm

Cevap

PowerShell memory-only execution matches Fileless Malware; Ring 0 DKOM manipulation matches Rootkit; Conditional script trigger matches Logic Bomb; Autonomous self-propagation matches Worm.
The paired classifications accurately reflect the technical behavior of each malware category: memory-only PowerShell execution represents fileless malware, Ring 0 DKOM manipulation represents a rootkit, conditional payload execution represents a logic bomb, and autonomous SMB scanning represents a worm.

Adım Adım Çözüm

1
Analyze the technical indicators in each scenario.
Identified volatile memory execution, kernel-level cloaking, triggered execution, and autonomous network propagation.
Differentiating malware types relies on analyzing execution mechanics, persistence mechanisms, and propagation behavior.
2
Map execution mechanics to malware definitions.
Living-off-the-land memory execution aligns with fileless malware, while Ring 0 system cloaking maps to rootkits.
Fileless malware minimizes disk footprint; rootkits conceal artifacts by altering low-level OS operations.
3
Map trigger conditions and propagation characteristics.
Status-triggered malicious scripts map to logic bombs; self-directed SMB scanning maps to worms.
Logic bombs rely on specific logical triggers, whereas worms actively scan and infect network targets independently.

Anahtar Kavram

Malware Types and Indicators of Compromise
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru