A SOC analyst responds to an alert regarding anomalous outbound network connections from a critical enterprise server. During incident triage, the analyst gathers the following telemetry artifacts:
- Volatile memory inspection shows shellcode executing directly within the allocated memory space of a legitimate `lsass.exe` process via reflective DLL injection.
- System logs indicate persistence was achieved via a non-standard WMI event consumer executing an encoded script payload.
- Comprehensive storage forensics confirm no new binary files, modified system executables, or untrusted drivers exist on disk.
Which of the following malware classifications best describes this attack vector?
- Fileless malwareCevap
- BTrojan
- CKernel-level rootkit
- DLogic bomb
Cevap
Fileless malware
Fileless malware operates entirely within volatile system memory (RAM) or uses built-in administrative framework tools (such as WMI and PowerShell) without dropping traditional executable files onto disk. The presence of reflective DLL injection in `lsass.exe` alongside WMI persistence and zero file system artifacts explicitly defines a fileless compromise.
Adım Adım Çözüm
Anahtar Kavram
Fileless malware and Living-off-the-Land (LotL) execution techniques