Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

An enterprise security analyst investigates a workstation after an employee reports unexpected system sluggishness. Detailed inspection of system logs reveals a persistent background process hook intercepting API keystrokes and capturing authentication session cookies. Further analysis of network flow records demonstrates stealthy, recurring outbound connections over non-standard ports transferring the collected data to an external address, while no attempts to scan or infect adjacent hosts are detected. Which of the following malware types and indicators of compromise are demonstrated in this incident? (Select TWO.)

  1. Spyware and keylogging functionality intercepting sensitive user input and credential dataCevap
  2. Command-and-control exfiltration evidenced by anomalous outbound network connectionsCevap
  3. C
    Self-propagating worm mechanisms actively probing network shares to replicate across the subnet
  4. D
    Host-based buffer overflow vulnerability mitigated primarily through perimeter firewall ingress port blocking

Cevap

The correct options are Spyware and keylogging functionality intercepting sensitive user input and credential data, and Command-and-control exfiltration evidenced by anomalous outbound network connections.
The scenario highlights two distinct indicators: local host API hooking to capture credentials (characteristic of spyware and keyloggers) and unauthorized outbound traffic transferring stole data to an external recipient (characteristic of command-and-control exfiltration).

Adım Adım Çözüm

1
Analyze host process indicators
Process hooking keyboard input APIs and stealing cookies indicates active spyware/keylogger malware.
Spyware covertly monitors user activities and gathers sensitive personal or authentication data.
2
Analyze network traffic indicators
Unusual outbound data transfers over non-standard ports to an external IP indicate covert exfiltration over a command-and-control channel.
Indicators of Compromise (IoCs) for C2 traffic frequently involve unauthorized outbound network flows carrying stolen data.
3
Evaluate distractor propagation and mitigation options
Rule out worm mechanisms due to lack of replication, and rule out firewall controls for host memory flaws.
Differentiating malware propagation types and selecting valid technical controls prevents misdiagnoses during incident triage.

Anahtar Kavram

Malware Indicators of Compromise and Spyware/C2 Telemetry Analysis
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru