Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

During an enterprise incident response triage, security engineers analyze a compromised domain controller demonstrating unauthorized administrative activity. Diagnostics reveal that the attack payload was injected directly into system RAM using a legitimate administrative utility, executing strictly in volatile memory without writing any standalone binary file to the host hard drive. Which of the following malware classifications best describes this type of threat?

  1. Fileless malwareCevap
  2. B
    Self-propagating worm
  3. C
    Trojan horse
  4. D
    Logic bomb

Cevap

Fileless malware
Fileless malware executes directly within volatile system memory (RAM) or piggybacks on legitimate host tools (such as PowerShell or WMI) without writing binary files to the storage drive, making traditional signature-based disk scans ineffective.

Adım Adım Çözüm

1
Analyze the technical indicators provided in the incident log scenario.
Identified that the payload resides and executes strictly within system volatile RAM and leaves no standalone binary artifacts on disk.
Understanding the persistence and storage medium helps classify the malware category.
2
Compare observed Indicators of Compromise (IoCs) against standard malware taxonomy definitions.
Malware that operates entirely in memory or leverages native system tools without leaving traditional file footprint matches the fileless malware classification.
Fileless attacks evade standard disk-based anti-virus signatures by avoiding traditional executable writes.

Anahtar Kavram

Fileless Malware Execution and Volatile Memory Indicators
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru