A security analyst is reviewing incident reports to classify different types of malicious software based on their core behavior and primary indicators of compromise. Match each malware type on the left with its corresponding technical indicator or defining behavior on the right.
- RansomwareEncrypts user files on local storage and network shares, displaying a payment demand for the decryption key.
- KeyloggerCaptures and records keystrokes entered on a system to harvest sensitive user credentials and data.
- RootkitModifies system files and kernel routines to conceal malicious processes and maintain stealthy privileged access.
- Logic BombLies dormant until a specific system event, date, or user condition triggers the execution of malicious code.
Cevap
Ransomware matches file encryption with payment demands; Keylogger matches capturing keystrokes to steal credentials; Rootkit matches modifying kernel routines to conceal processes; Logic Bomb matches remaining dormant until a specific trigger condition occurs.
Each malware type is paired correctly with its defining behavior: Ransomware encrypts data for ransom, Keyloggers record input keystrokes, Rootkits modify OS kernel routines for stealth, and Logic Bombs execute payloads upon specific conditional triggers.
Adım Adım Çözüm
Anahtar Kavram
Malware Classification and Telemetry Indicators