Examkin

Soru

Zorluk: ZorMalware Types and Indicators of Compromise

Forensic examination of an compromised enterprise host reveals anomalous system behavior where administrative utilities fail to display running processes and active network sockets that are visibly present in raw memory captures. Further inspection demonstrates that kernel-level System Service Descriptor Table (SSDT) function pointers have been redirected to execute code in unallocated memory addresses, effectively intercepting and filtering operating system API responses. Which of the following malware classifications is primarily indicated by these technical indicators of compromise?

  1. RootkitCevap
  2. B
    Worm
  3. C
    Trojan
  4. D
    Logic Bomb

Cevap

Rootkit
The correct answer is Rootkit because the scenario describes SSDT (System Service Descriptor Table) hooking and low-level system call manipulation. Rootkits operate at a deep privileged level (often kernel mode) to intercept operating system requests, hiding running processes, files, and socket connections from security controls and system administrators.

Adım Adım Çözüm

1
Analyze host indicators of compromise (IoCs)
Identified discrepancy between raw RAM captures and OS tool outputs, alongside modified SSDT kernel function pointers.
Discrepancies in system state visibility indicate that lower-level operating system APIs are actively filtering diagnostic query outputs.
2
Evaluate malware behavior mechanisms
Kernel table pointer redirection (SSDT hooking) subverts native system calls at the OS ring 0 boundary.
Intercepting system calls to conceal malicious processes and network sockets is the hallmark persistence and evasion technique of rootkits.
3
Select matching malware classification
Rootkit is confirmed as the correct malware category.
Rootkits specifically focus on deep OS control and stealth through driver-level or kernel-level modifications.

Anahtar Kavram

Rootkit Indicators of Compromise and Kernel Hooking Mechanisms
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru