Examkin

Soru

Zorluk: OrtaMalware Types and Indicators of Compromise

A security analyst conducts incident triage on an enterprise server and uncovers two distinct anomalous indicators:

1. The standard administrative utility binary on disk was replaced with a compromised version that allows unauthorized access using a hardcoded master key.
2. A loadable kernel module is actively intercepting system calls to modify process listings, effectively hiding malicious processes and network sockets from diagnostic commands.

Which of the following malware classifications or mechanisms are directly demonstrated by these forensic findings? (Select TWO)

  1. Trojan execution via system binary replacementCevap
  2. Rootkit functionality through kernel-level hook interceptionCevap
  3. C
    Self-propagating worm capabilities operating over open socket connections
  4. D
    Logic bomb activation based on preconfigured system environment triggers

Cevap

The correct selections are Trojan execution via system binary replacement and Rootkit functionality through kernel-level hook interception.
The scenario demonstrates Trojan malware because a legitimate utility executable was modified to include an unauthorized backdoor. Additionally, rootkit functionality is present because a loadable kernel module subverts system call outputs to hide processes and network connections from administrators.

Adım Adım Çözüm

1
Analyze Indicator 1 (Replacing a legitimate administrative utility with a malicious version that includes a master key).
Identify that disguising malicious functionality within legitimate system binaries corresponds to Trojan malware.
Trojans masquerade as or overwrite benign software components to establish unauthorized administrative access.
2
Analyze Indicator 2 (Utilizing a kernel module to intercept system calls and hide running processes/sockets).
Identify that low-level stealth techniques modifying kernel system calls to conceal system state correspond to Rootkits.
Rootkits operate at deep system levels (such as kernel space) to subvert operating system reporting tools and evade detection.
3
Evaluate remaining choices against observed telemetry.
Exclude self-propagating worms and logic bombs because no autonomous network replication or logical execution triggers are indicated.
Worms focus on spreading automatically across networks, while logic bombs require specific event conditions to launch.

Anahtar Kavram

Malware Indicators of Compromise (Trojans vs Rootkits)
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru