Examkin

Soru

Zorluk: Çok zorMalware Types and Indicators of Compromise

During a proactive security audit of a mission-critical database server, a security engineer compares user-mode system monitoring logs with low-level kernel telemetry. Standard operating system process enumeration APIs display 48 active processes, but a direct memory analysis of kernel structures reveals an additional executive process block (EPROCESS) decoupled from the ActiveProcessLinks doubly linked list. The unlisted process actively hooks system calls to subvert detection. Which of the following malware classifications best describes this threat?

  1. RootkitCevap
  2. B
    Self-propagating worm
  3. C
    Logic bomb
  4. D
    Remote Access Trojan (RAT)

Cevap

Rootkit (specifically operating via Direct Kernel Object Manipulation)
The scenario describes Direct Kernel Object Manipulation (DKOM), where malware modifies kernel data structures (such as unlinking an EPROCESS block from the ActiveProcessLinks list) to hide running processes from standard OS process enumeration APIs while maintaining active execution. This kernel-level stealth mechanism is characteristic of a rootkit.

Adım Adım Çözüm

1
Analyze the telemetry discrepancy between standard API calls and kernel memory structures.
Standard APIs report 48 processes, while kernel memory inspection identifies 49 active executive process blocks.
Security utilities rely on system APIs that walk doubly linked lists like ActiveProcessLinks; removing an entry hides the process from standard tools.
2
Evaluate the behavior of the unlisted process modifying system calls.
The process executes syscall hooking to intercept OS monitoring and maintain stealth.
Hiding processes at the operating system kernel level via kernel structure manipulation is a definitive characteristic of kernel-mode rootkits.
3
Map the technical Indicators of Compromise (IoCs) to malware types.
Direct Kernel Object Manipulation (DKOM) and system call hooking align specifically with rootkit malware.
Other malware categories target execution, propagation, or triggers rather than deep kernel stealth mechanics.

Anahtar Kavram

Rootkit stealth mechanisms and Direct Kernel Object Manipulation (DKOM)
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru