Match each technical host telemetry artifact and indicator of compromise with its corresponding malware classification.
- Kernel callback object modification paired with active process unlinking via Direct Kernel Object Manipulation (DKOM) in kernel memory structures.Kernel-level Rootkit
- Persistent WMI event subscription executing an obfuscated PowerShell payload directly in RAM via reflective DLL injection without writing binary files to disk.Fileless Malware
- System process executing commands to disable volume shadow copies while recursively encrypting specific file headers using AES-GCM algorithms.Ransomware
- Dormant code segment embedded in a legitimate application that monitors Active Directory domain controller time and executes a destructive payload upon reaching a specified date.Logic / Time Bomb
Cevap
Kernel memory modification via DKOM matches Kernel-level Rootkit; WMI persistent memory injection matches Fileless Malware; cryptographic file encryption and shadow copy deletion match Ransomware; condition-triggered dormant execution matches Logic / Time Bomb.
Each malware classification is accurately paired with its distinct technical operational footprint: kernel rootkits modify core OS memory structures via Ring 0 privileges; fileless malware executes in RAM without traditional disk artifacts; ransomware inhibits host recovery while encrypting data storage; and logic/time bombs depend on specific environmental triggers.
Adım Adım Çözüm
Anahtar Kavram
Distinguishing Malware Categories via Technical Telemetry and Indicators of Compromise