Examkin

Soru

Zorluk: ZorMalware Types and Indicators of Compromise

During an incident response investigation, a security analyst reviews an Endpoint Detection and Response (EDR) alert on a enterprise workstation. Telemetry logs show that a user opened a weaponized document that invoked PowerShell. The script executed directly within system memory, injected shellcode into a legitimate system process, established an encrypted reverse shell, and modified registry run keys for persistence without creating executable binary files on the local disk. Which of the following malware classifications best describes this threat?

  1. Fileless malwareCevap
  2. B
    Self-propagating worm
  3. C
    Host-based rootkit
  4. D
    Logic bomb

Cevap

Fileless malware
Fileless malware operates in volatile memory (RAM) and uses built-in administrative tools such as PowerShell or Command Prompt (living-off-the-land techniques). Because no malicious executable binaries are written to disk, traditional file-based antivirus solutions often fail to detect it.

Adım Adım Çözüm

1
Analyze host log indicators and execution path
Identified PowerShell launching from a document macro and executing payload directly in system RAM.
Tracking the execution chain reveals how the initial access vector initiated code execution.
2
Evaluate disk activity and persistence mechanisms
No new executable files (.exe, .dll) were written to disk; persistence relies on registry keys calling built-in utilities.
Absence of traditional disk-based malicious binaries is the hallmark signature of fileless attacks.
3
Synthesize indicators to determine malware type
Memory-resident execution using native OS binaries (Living off the Land) classifies the attack as fileless malware.
Fileless threats leverage system tools (e.g., PowerShell, WMI) to operate inside RAM without dropping files.

Anahtar Kavram

Fileless Malware Telemetry and Indicators of Compromise
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru