Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

During an incident response investigation, a Security Operations Center (SOC) analyst isolates an endpoint after Endpoint Detection and Response (EDR) telemetry alerts on anomalous process behavior. Further forensic analysis reveals that malicious payload execution occurred directly within system memory (RAM) via process injection into `explorer.exe` using encoded PowerShell commands, leaving zero binary artifacts on the local disk. Which of the following malware classifications best describes this attack?

  1. Fileless malwareCevap
  2. B
    Self-propagating worm
  3. C
    Remote access Trojan
  4. D
    Kernel-level rootkit

Cevap

Fileless malware is the correct classification because the attack relies on running malicious payloads strictly in volatile memory (RAM) via process injection and native administrative utilities without writing executable files to disk.
Fileless malware executes directly in system RAM by injecting code into trusted processes (such as `explorer.exe`) or executing scripts via administrative tools like PowerShell. Because no malicious binary file is saved to the hard drive, traditional file scanner antivirus mechanisms fail to detect it.

Adım Adım Çözüm

1
Analyze the technical indicators of compromise (IoCs) described in the EDR alert.
The identified IoCs include memory-resident execution in RAM, process injection into `explorer.exe`, abuse of PowerShell, and the absence of file artifacts on local storage.
Categorizing malware requires identifying the execution environment, storage footprint, and persistence mechanisms.
2
Evaluate the identified IoCs against malware operating modes.
Malware that resides purely in RAM and abuses living-off-the-land binaries (LotL) matches the core characteristics of fileless malware.
Fileless attacks bypass conventional signature scanning by executing payloads entirely within legitimate host memory spaces.

Anahtar Kavram

Fileless malware and memory-resident execution techniques
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru