More Malware & Attack Types
180 cards · 13 sections
Sections▾
Malware (OBJ 2.4)
Malware
Malicious software designed to infiltrate, disrupt, damage, or gain unauthorized access to a computer system without the user's knowledge or consent.
Threat Vector
The means or pathway by which a threat approaches a target system and may deliver a malicious payload or unwanted action.
Attack Vector
The specific path or method used by an attacker to gain unauthorized access, execute compromise, or deliver malware.
Virus
Malicious code that attaches itself to a clean file and spreads when that file is opened or executed. A virus often corrupts, modifies, or damages the infected host files.
Worm
A standalone self-replicating malware that spreads automatically to other systems, often by exploiting software vulnerabilities and without requiring direct user action.
Trojan
Malicious software disguised as legitimate or desirable software that performs hidden malicious actions when the user executes it.
Remote Access Trojan (RAT)
A Trojan variant that provides an attacker with remote access to and control over an infected host after the malicious software is executed.
Ransomware
Malware that encrypts a user's files or blocks access to a system and then demands payment in exchange for a decryption key or restored access.
Zombie
A compromised computer or device that is remotely controlled by an attacker and often operates as part of a botnet without the user's knowledge.
Botnet
A network of compromised computers or devices, called zombies, that are remotely controlled by an attacker for coordinated malicious activity.
Rootkit
Malicious software designed to gain administrative-level or root-level control of a system while remaining hidden from users, administrators, and security tools.
Backdoor
A covert method used to bypass normal authentication or security controls to gain unauthorized access to a system.
Logic Bomb
Malicious code inserted into a program that performs a harmful action only when a specific condition or trigger is met.
Keylogger
A software or hardware tool that covertly records keystrokes on a computer or mobile device to capture credentials and other sensitive information.
Spyware
Malicious software designed to gather and send information about a user or organization without the user's knowledge or consent.
Bloatware
Software that comes pre-installed on a new computer or smartphone that the user did not request, want, or need. Bloatware is usually not malicious, but it consumes system resources and storage.
Objective scope for this section
Domain 2, Objective 2.4 focuses on analyzing indicators of malicious activity and identifying malware-related attack behavior.
Threat vector vs attack vector
These terms are related but not interchangeable in scenario analysis:
- Threat vector: the means or pathway used to approach a target and deliver a malicious payload or unwanted action
- Attack vector: operational method used to exploit exposure and execute infection
- Exam pattern: identify both the vulnerable condition and the exploitation sequence
Core malware list for this objective segment
Knowthese malware categories and related mechanisms:
- Virus
- Worm
- Trojan
- Remote Access Trojan (RAT)
- Ransomware
- Zombie
- Botnet
- Rootkit
- Backdoor
- Logic bomb
- Keylogger
- Spyware
- Bloatware
WannaCry case pattern (MS17-010 / EternalBlue)
WannaCry to illustrate vector chaining from weakness discovery to ransomware impact:
- Unpatched Windows hosts expose Server Message Block (SMB) risk
- Automated scanning identifies vulnerable systems
- Exploit execution gains elevated access
- Ransomware encrypts files and demands payment
Indicators of malicious activity to watch for
Objective 2.4 emphasizes recognizing these signals in incident scenarios:
- Account lockouts
- Concurrent session utilization
- Blocked content
- Impossible travel
- Resource consumption
- Resource inaccessibility
- Out-of-cycle logging
- Missing logs
- Published or documented attacks
Known weakness present but not yet exploited -> Vulnerability
Scenario describes a missing patch or other weakness without active compromise steps -> classify it as a vulnerability, not an attack vector.
Scan + exploit + malware deployment chain -> Attack vector
Scenario includes the attacker path from discovery to exploitation and infection -> classify as attack vector.
File encryption with payment demand -> Ransomware
Scenario shows locked/encrypted data and decryption payment request (often cryptocurrency) -> identify ransomware.
Compromised hosts controlled in bulk for DDoS/spam -> Botnet
Scenario references many infected machines controlled together for coordinated actions -> identify zombie/botnet operations.
Viruses (OBJ 2.4)
Computer Virus
Malicious code that attaches to a file or program and infects a system when the infected content is opened or executed by a user.
Boot Sector Virus
A virus stored in the boot sector of storage media that loads into memory during system startup, before the operating system initializes.
Macro Virus
A virus embedded in macro-enabled documents that executes when the file is opened and macros are allowed.
Program Virus
A virus that infects executable/application files so execution of the compromised program triggers repeated infection behavior.
Multipartite Virus
A hybrid virus that combines multiple infection methods, commonly boot sector plus program infection, to increase persistence.
Encrypted Virus
A virus that encrypts its malicious payload or code to reduce static signature visibility.
Polymorphic Virus
A virus that mutates code/decryption characteristics across executions to evade signature-based detection.
Metamorphic Virus
An advanced virus that rewrites its own code structure before infecting additional files.
Stealth Virus
A virus using concealment techniques to hide infection activity and avoid anti-virus detection.
Armored Virus
A virus designed with anti-analysis protections to hinder reverse engineering and detection.
Virus Hoax
A technical social engineering deception that falsely claims infection to trick users into unsafe actions, malware installation, payment, or remote access.
Core virus list for this objective segment
Knowthese 10 categories:
- Boot sector virus
- Macro virus
- Program virus
- Multipartite virus
- Encrypted virus
- Polymorphic virus
- Metamorphic virus
- Stealth virus
- Armored virus
- Hoax virus
User action commonly initiates infection
that virus execution often begins when a user runs infected content.
- Open/run untrusted installer or executable
- Enable/execute malicious macros in documents
- Follow deceptive prompts that trigger unsafe actions
Persistence and evasion are layered
Modern virus behavior often combines persistence methods and anti-detection techniques.
- Persistence examples: boot-time load and reinfection via applications
- Evasion examples: encryption, polymorphism, metamorphism, stealth, armor
- Composite threat pattern: multiple categories combined in one malware strain
Loads before operating system startup -> Boot sector virus
Scenario indicates infection executes during boot sequence prior to normal operating system controls -> identify boot sector virus behavior.
Infection triggered by document macros -> Macro virus
Scenario references malicious behavior after opening document/spreadsheet/presentation with macro execution -> identify macro virus.
Code mutates to evade signatures -> Polymorphic or metamorphic virus
Scenario describes changing malware code across runs to avoid signature detection -> classify as polymorphic/metamorphic technique set.
Fake infection popup drives unsafe action -> Hoax (social engineering)
If the message claims infection and pushes payment, download, or remote support without verified compromise -> treat as hoax-driven social engineering.
Worms (OBJ 2.4)
Worm
A self-replicating malware that spreads automatically by exploiting vulnerabilities, without requiring direct user action.
Virus vs Worm
A virus generally requires user-triggered execution, while a worm can autonomously scan, exploit, and propagate.
Botnet Enrollment
The process of adding compromised systems to an attacker-controlled network for coordinated malicious activity.
Core behavior of worm propagation
Worms spread by combining automated discovery with exploit-driven compromise:
- Scan network/internet for reachable targets
- Identify hosts with known unpatched vulnerabilities
- Exploit vulnerability to execute code remotely
- Replicate from newly compromised host
Why worms are operationally dangerous
Worm risk includes both compromise and service degradation due to replication pressure.
- Compromise of multiple endpoints/servers
- Bandwidth and network capacity exhaustion
- Increased CPU and memory usage on infected hosts
- Potential denial-of-service conditions from rapid spread
Historical examples
Nimda and Conficker to show scale and speed of worm outbreaks:
- Nimda (2001): rapid internet-wide propagation in a short window
- Conficker (2009): large-scale infection of systems missing Microsoft patch MS08-067
- Conficker added infected hosts to a botnet after exploitation
Primary mitigation theme
vulnerability management and patching as critical controls against worm spread.
- Maintain timely security patching across operating systems and applications
- Reduce exposed vulnerable services where possible
- Use layered security controls to limit exploitability and propagation
Malware spreads without user click/open action -> Worm
Scenario shows autonomous propagation by exploiting vulnerabilities with no direct user interaction -> identify worm behavior.
User opens infected file and malware executes -> Virus
Scenario requires user-triggered execution event (open file/click link/run program) -> identify virus pattern.
Missing security patch followed by rapid host-to-host spread -> Worm outbreak path
Scenario links unpatched systems to automated scanning/exploitation and widespread replication -> classify as worm-style propagation.
Compromised hosts grouped for attacker-controlled actions -> Botnet
If infected endpoints are centrally coordinated for follow-on operations, recognize botnet formation after worm compromise.
Trojans (OBJ 2.4)
Trojan
Malicious software disguised as legitimate or desirable software that performs hidden malicious actions after execution.
Remote Access Trojan (RAT)
A Trojan subtype that establishes attacker-controlled remote access to an infected system after the victim executes the disguised malicious software.
Backdoor
A covert method of bypassing normal authentication or security controls that can be implanted by Trojan activity to preserve attacker access.
Trojan execution model
Trojans rely on trust and user execution of software that appears benign.
- User installs or runs software believed to be safe/desirable
- Expected visible function may still work normally
- Hidden payload runs in parallel and establishes compromise
Primary post-infection objectives
common Trojan outcomes after initial compromise:
- Remote control of victim endpoint (RAT behavior)
- Data exfiltration of sensitive documents
- Backdoor creation for persistence and future access
Trojan trust-abuse pattern
The exam cue is not the story itself but the underlying trust model:
- Harmless appearance conceals hostile intent
- Victim permits entry into protected environment
- Hidden attacker capability is activated after acceptance
Software appears legitimate but performs hidden malicious action -> Trojan
Scenario shows a program delivering expected function while covertly installing malicious capability -> classify as Trojan.
Attacker gains remote control after user runs infected software -> Remote Access Trojan (RAT)
Scenario includes unauthorized remote session/command execution initiated by disguised software -> identify RAT behavior.
Trusted download source not verified before install -> Elevated Trojan risk
Scenario emphasizes unverified downloads and immediate execution without scanning -> prioritize Trojan delivery risk and preventive controls.
Rootkit (OBJ 2.4)
Rootkit
Malicious software designed to gain administrative-level or root-level control of a system while remaining hidden from users, administrators, and security tools.
Kernel Mode (Ring 0)
The most trusted and powerful operating system execution level, with direct access to core system functions and device interaction.
DLL Injection
A technique that runs arbitrary code inside another process by forcing it to load a malicious dynamic-link library (DLL).
Shim
Code placed between two components to intercept and redirect function calls, which can be abused by a rootkit to hide malicious behavior.
Primary rootkit objective
A rootkit seeks the highest privilege possible while staying hidden on the compromised system.
- Gain administrative or root-level control
- Move as close to ring 0 as possible
- Avoid detection by the operating system and security tools
Operating system ring model
rootkit power in terms of privilege rings, but the exam distinction that matters most is user mode versus kernel mode:
- Ring 3: user mode with standard user permissions
- Ring 0: kernel mode with the highest trust and control
- Ring 1 is a privileged or administrative level, but the rootkit exam cue is malware seeking stealthy kernel-level control as close to ring 0 as possible
Why rootkits are hard to detect
Rootkits embed deeply into operating system activity, allowing them to hide from normal in-band security inspection.
- Operate with elevated or kernel-adjacent privileges
- Can intercept or redirect normal operating system calls
- Traditional antivirus and anti-malware tools may not see the hidden malicious code
DLL injection and shim abuse path
rootkit stealth to trusted Windows DLL behavior and call interception.
- Malicious code is inserted into the address space of another process
- A trusted DLL load path is abused to execute the rootkit
- A shim intercepts and redirects calls between the operating system and the DLL
Malware seeks hidden administrative or kernel-level control -> Rootkit
Scenario emphasizes stealth plus privileged system-level access close to ring 0 -> identify a rootkit.
Security tools inside the infected operating system cannot see the malware -> Use offline rootkit scan
If the malware is deeply embedded and hiding from the active operating system, the primary detection method is to boot from trusted external media and scan the internal drive.
Injected DLL plus call redirection inside a trusted process -> Rootkit technique
Scenario includes DLL injection, shim-based interception, or hidden code running inside another process -> classify it as rootkit-style stealth and persistence.
Viruses and Trojans (OBJ 2.4)
Remote Access Trojan (RAT)
A Trojan subtype that gives an attacker remote control of an infected system after the user executes disguised malicious software.
Social Engineering Delivery
The use of deception to trick a user into downloading, opening, or installing malicious content.
Legacy Unsupported System
An operating system that no longer receives security patches, increasing exposure to known vulnerabilities and malware compromise.
Exam focus of the demonstration
Focus on malware recognition, not malware creation. For the exam, focus on what a virus or Trojan does after compromise and how it is delivered.
User execution is the key delivery event
The demonstration shows that both virus and Trojan infection begin when the victim is tricked into running a disguised file.
- Download of a file presented as something harmless or desirable
- Execution of the file by the user
- Malicious behavior begins after the program is opened
Legacy systems are easier malware targets
an unsupported Windows 7 system to show that unpatched, legacy hosts are more vulnerable to compromise than modern, defended systems.
- No new security patches for unsupported operating systems
- Known vulnerabilities remain exposed
- Modern anti-malware tools are more likely to block older malware on newer systems
Remote Access Trojan (RAT) post-compromise capabilities
A RAT can provide broad attacker control over the victim endpoint after execution.
- Collect system and host information
- Capture screenshots or webcam data
- Browse, copy, or exfiltrate files
- Modify registry or desktop settings
- Send messages or manipulate the user interface
File looks like a picture, game, or utility but runs malware -> Social engineering delivery
Scenario shows a harmless-looking file used to trick the victim into launching malicious code -> identify social engineering as the delivery mechanism.
User runs disguised file and attacker gains remote control -> Remote Access Trojan (RAT)
Scenario includes unauthorized remote access, file browsing, screenshots, or system manipulation after execution -> identify a RAT.
Unsupported operating system with no patches -> Higher malware exposure
Scenario highlights a legacy system that no longer receives updates -> prioritize unpatched vulnerability risk and increased malware susceptibility.
Ransomware (OBJ 2.4)
Ransomware
A type of malicious software designed to block access to a computer system or its data by encrypting it until a ransom is paid.
Decryption Key
The key attackers claim will restore access to encrypted files after a ransom payment.
Known Good Backup
A trusted backup copy created before compromise that can be used to restore systems and data after ransomware is removed.
Multi-Factor Authentication (MFA)
An authentication control that requires more than one factor to verify identity and makes unauthorized access more difficult for attackers.
Primary ransomware behavior
Ransomware blocks access to systems or data by encrypting files and then demanding payment in exchange for a decryption key.
Real-world impact can extend beyond IT systems
Colonial Pipeline and University Hospital Dusseldorf to show that ransomware can disrupt critical infrastructure and create real-world safety consequences.
- Operational shutdowns and service outages
- Supply disruption and financial impact
- Patient diversion and life-safety consequences in healthcare environments
4 preventive controls
four practices that reduce ransomware risk and improve resilience:
- Conduct regular backups, including offline or offsite copies
- Install software and operating system updates regularly
- Provide security awareness training to end users
- Implement Multi-Factor Authentication (MFA)
4 response priorities after infection
these immediate response actions when ransomware is detected:
- Do not pay the ransom
- Disconnect the affected system from the network
- Follow organizational incident response processes and notify authorities as appropriate
- Restore systems and data from known good backups after malware removal
Encrypted files plus payment demand -> Ransomware
Scenario shows loss of access to data with a demand for money or cryptocurrency in exchange for recovery -> identify ransomware.
Single connected backup also gets encrypted -> Backup design failure
Scenario uses only one attached backup device and ransomware encrypts it too -> the better answer is offline, offsite, or cloud-isolated backup strategy.
Phishing email link or attachment starts the attack -> User awareness training gap
Scenario begins with an end user clicking a suspicious email link or attachment -> identify phishing as the vector and awareness training as a key preventive control.
Suspected ransomware on one machine -> Disconnect from network first
Scenario asks for the immediate containment action after detecting ransomware -> isolate the infected system from the network.
Zombies and Botnets (OBJ 2.4)
Botnet
A network of compromised computers or devices controlled remotely by malicious actors and used for cyber attacks or other malicious activity.
Zombie
A single compromised computer or device that is part of a botnet and performs tasks by remote command without the user's knowledge.
Command and Control (C2) Node
The control point attackers use to issue commands to compromised systems inside a botnet.
Distributed Denial of Service (DDoS)
An attack in which many machines target one victim simultaneously to overwhelm its resources and make the service unavailable.
Botnet structure
A botnet is built by compromising many devices and grouping them under remote attacker control.
- Each compromised device is a zombie
- The attacker controls zombies through a Command and Control (C2) node
- Hundreds, thousands, or millions of zombies can act as one malicious network
Common botnet uses
several ways attackers use the combined resources of compromised systems:
- Distributed Denial of Service (DDoS) attacks
- Spam and phishing distribution
- Cryptocurrency mining
- Breaking encryption through distributed brute-force processing
- Using zombies as pivot points to reach additional victims
Resource use is often limited to avoid detection
Attackers often use only part of a victim's processing power so the compromise is less obvious.
- Using 20 to 25% of processing power is less noticeable
- Using nearly all CPU would make the device unresponsive
- Lower visible impact helps the zombie remain in the botnet longer
One compromised endpoint receiving remote commands -> Zombie
Scenario describes a single infected workstation or device acting under remote control inside a broader network -> identify a zombie.
Many compromised systems under one attacker -> Botnet
Scenario describes a coordinated network of infected machines managed together for attacks or abuse -> identify a botnet.
Many infected hosts overwhelm one target -> Distributed Denial of Service (DDoS)
Scenario shows numerous compromised devices hitting one server until service fails -> identify a DDoS attack launched through a botnet.
Unexpected background CPU usage across many infected machines -> Botnet cryptomining
Scenario describes attacker-controlled hosts quietly contributing processing power for cryptocurrency mining -> identify botnet-based cryptomining.
Backdoors and Logic Bombs (OBJ 2.4)
Backdoor
A covert method of bypassing normal authentication or security controls, often introduced by a system designer or programmer to regain hidden access.
Remote Access Trojan (RAT)
A Trojan subtype that gives a threat actor remote access to an infected system and can function like a backdoor after malware is installed.
Easter Egg
A hidden feature or novelty intentionally inserted into software by developers, usually as a joke or secret function rather than for a legitimate business need.
Logic Bomb
Malicious code inserted into software that performs a harmful action only when a specific condition, event, or trigger is met.
Why backdoors are insecure
Historically, programmers added backdoors to simplify maintenance access, but modern secure coding treats them as a serious security weakness.
- Bypass normal authentication and firewall protections
- Create hidden access paths into the application or system
- Violate secure coding best practices
Backdoor vs RAT distinction
these concepts but they are not identical.
- Backdoor: the hidden bypass method that avoids normal authentication or security controls
- RAT: malware that gives the attacker remote access and may act like a backdoor after infection
- Exam focus: a programmer-created hidden maintenance path points to a backdoor, while attacker-installed remote control points to a RAT
Easter Egg vs logic bomb
Both involve hidden code, but harmless novelty is distinct from malicious intent.
- Easter Egg: hidden joke, novelty, or secret feature
- Logic bomb: malicious code with a conditional trigger
- Exam focus: logic bomb includes harmful intent and a trigger condition
Common logic bomb trigger pattern
A logic bomb waits for a predefined state, event, or time before executing a harmful action.
- Specific time or date is reached
- Specific account or system condition changes
- Malicious action executes only after the trigger is satisfied
Hidden maintenance path bypasses normal authentication -> Backdoor
Scenario shows covert access intentionally built to avoid the normal login or security controls, especially by a designer or programmer -> identify a backdoor.
Malware installs callback access for later attacker re-entry -> Remote Access Trojan (RAT) acting as backdoor
If the attacker regains access through a persistent callback connection after the victim runs malware, classify it as RAT behavior functioning like a backdoor.
Hidden code activates only when a condition is met -> Logic bomb
Scenario includes malicious code that waits for a specific date, time, account deletion, or other trigger before causing harm -> identify a logic bomb.
Hidden novelty feature without harmful intent -> Easter Egg
If the hidden code is described as a joke or secret feature rather than malicious sabotage, identify it as an Easter Egg, not a logic bomb.
Keylogger (OBJ 2.4)
Keylogger
A software or hardware tool that covertly records keystrokes on a computer or mobile device without the victim's knowledge or consent.
Software-Based Keylogger
A malicious program installed on a victim system that silently captures typed input and sends it to a threat actor.
Hardware-Based Keylogger
A physical device attached to or embedded in the keyboard path that captures keystrokes while appearing to the system as a normal input device.
Keystroke Encryption
A defensive control that scrambles typed input before transmission so captured keystrokes are less useful to an attacker.
Why keyloggers are dangerous
Keyloggers are stealthy and effective because they capture data exactly as the victim types it.
- Usernames and passwords can be stolen directly from keystrokes
- Financial and personal information can be captured without visible warning
- Captured data can enable identity theft, fraud, or espionage
Software vs hardware keylogger distinction
scale-friendly malware delivery from physically installed devices.
- Software keylogger: delivered through malware bundling or social engineering
- Hardware keylogger: requires physical access to install
- Hardware keylogger: harder to scale but avoids software-only detection
Business impact can exceed personal theft
In enterprise environments, keyloggers can expose more than just credentials.
- Confidential emails and proprietary data may be captured
- Strategic plans and internal communications may be exposed
- Financial, legal, and reputational damage can follow
Primary defense stack
six complementary ways to reduce keylogger risk:
- Patch and update systems regularly
- Use antivirus and anti-malware with regular scans
- Train users against phishing and pretexting
- Implement Multi-Factor Authentication (MFA)
- Use keystroke encryption
- Inspect hardware for unfamiliar devices
User input is secretly recorded to steal credentials -> Keylogger
Scenario focuses on covert capture of typed usernames, passwords, credit card numbers, or searches -> identify a keylogger.
Physical USB-like device or altered keyboard cable captures input -> Hardware-based keylogger
If the compromise depends on a device physically attached to the workstation and not software installation, classify it as a hardware keylogger.
Password stolen but attacker still blocked by second factor -> Multi-Factor Authentication (MFA) mitigates keylogger risk
Scenario shows typed credentials were captured but access still failed because an additional verification factor was required -> identify MFA as the primary mitigating control.
Captured keystrokes become unreadable ciphertext -> Keystroke encryption
If the lesson scenario emphasizes scrambling typed input before the system receives it, identify keystroke encryption as the protective mechanism.
Spyware and Bloatware (OBJ 2.4)
Spyware
Malicious software that covertly gathers and transmits information about a user or organization without their knowledge or consent.
Bloatware
Pre-installed software on a new device that the user did not request, want, or need. It is usually not malicious, but it consumes storage, memory, and other system resources.
End User License Agreement (EULA)
The legal agreement presented with software that may disclose data collection practices and other usage terms.
What spyware captures
that spyware targets both behavioral data and sensitive information.
- Browsing habits and software usage patterns
- Passwords and credit card numbers
- Other personal or organizational data
Typical spyware delivery paths
Spyware often reaches systems through deceptive or bundled software distribution.
- Bundled software installers
- Malicious websites
- Deceptive pop-up advertisements
Why bloatware still matters
Bloatware is usually not malicious, but it still creates operational and security problems.
- Consumes storage and RAM
- Slows overall device performance
- Increases attack surface because unnecessary software may contain exploitable bugs
Primary defenses and cleanup actions
preventive and corrective actions for both spyware and bloatware:
- Use updated antivirus and anti-spyware tools
- Download software only from trusted sources
- Review the EULA for data collection disclosures
- Patch operating systems and applications
- Remove unwanted software manually or with removal tools
- Use a clean operating system installation for new devices when appropriate
Software secretly monitors habits and steals personal data -> Spyware
Scenario includes covert tracking of browsing, usage patterns, passwords, or card data -> identify spyware.
New device includes unwanted trial apps and promotional software -> Bloatware
If the software was pre-installed by the vendor or manufacturer and wastes space or memory without being overtly malicious, classify it as bloatware.
Unneeded pre-installed apps increase exposure -> Attack surface expansion
Scenario focuses on extra vendor-installed software creating more exploitable code paths -> identify increased attack surface from bloatware.
Primary reset option for a new device full of vendor software -> Clean operating system installation
If the goal is to remove pre-installed software comprehensively and start from a trusted baseline, identify a clean operating system installation.
Malware Attack Techniques (OBJ 2.4)
Malware Exploitation Technique
A specific method by which malware code penetrates and infects a targeted system.
Dropper
A specific malware type designed to initiate, install, or run other malware payloads on an infected host.
Downloader
Malware that retrieves additional malicious tools, code, or payloads after the initial infection has occurred.
Shellcode
Lightweight code used to execute an exploit or initiate malicious activity on a target system, often as part of a first-stage payload.
Fileless Malware
Malware that primarily executes in memory as a script or shellcode with little or no dependence on the local file system, making it harder for signature-based tools to detect.
Code Injection
A technique that inserts malicious code into a legitimate process so the malware runs under that process identity.
Masquerading
A technique where malware disguises itself as a legitimate file, process, or name to avoid suspicion and detection.
DLL Injection
A technique that forces a process to load a malicious dynamic-link library (DLL) so arbitrary code runs inside another process.
DLL Sideloading
A technique that abuses an application's DLL search order so a malicious DLL is loaded instead of the legitimate library.
Process Hollowing
A technique that starts a legitimate process and replaces its memory with malicious code while keeping the trusted-looking process name.
Concealment
A post-compromise phase in which the attacker hides tracks, erases log files, or disguises evidence to prolong unauthorized access.
Living off the Land
An attack technique that abuses built-in operating system tools, such as PowerShell, to perform malicious actions while reducing the need to download obvious malware.
Traditional vs fileless malware execution
older file-based infection methods with modern in-memory execution.
- Traditional malware modifies executables or embeds malicious macros in documents
- Some worms infect memory and spread over the network
- Fileless malware executes in memory as scripts or shellcode and leaves fewer file artifacts
Why fileless malware is harder to detect
Modern malware reduces reliance on the file system to evade signature-based defenses.
- Bypasses signature-based antivirus and anti-malware tools more easily
- Creates malicious processes directly in system memory
- May erase temporary file traces after execution
Two-stage malware deployment model
a staged infection sequence commonly used in enterprise compromises.
- Stage one: a dropper or downloader gains execution and retrieves additional code
- Stage two: more tooling such as a Remote Access Trojan (RAT) is installed to establish command and control
- After access is established, the attacker expands compromise and pursues action on objectives
Post-compromise workflow
After initial infection, the attacker moves through expansion, objective execution, and concealment.
- Spread laterally and target servers or domain controllers
- Conduct action on objectives such as exfiltration or ransomware
- Hide activity through concealment and log removal
Malware deployment and anti-forensic techniques
several execution and evasion methods used to disguise malicious activity.
- Code injection, masquerading, DLL injection, DLL sideloading, and process hollowing
- Encryption, compression, and obfuscation to hinder analysis
- Living off the land through built-in tools such as PowerShell
Malware runs in memory with minimal file traces -> Fileless malware
Scenario emphasizes in-memory execution, limited filesystem artifacts, and evasion of signature-based tools -> identify fileless malware.
Initial lightweight payload fetches more malware -> Dropper or downloader
If the first-stage code exists mainly to retrieve or launch additional malicious payloads, classify it as a dropper/downloader stage.
Attacker abuses PowerShell or other built-in tools -> Living off the land
Scenario shows native operating system utilities being used for malicious execution, persistence, or lateral movement -> identify living off the land.
Attacker hides evidence after compromise -> Concealment phase
If the scenario focuses on log deletion, hiding tracks, or disguising malicious activity after the objective is carried out, identify concealment.
Indications of Malware Attacks (OBJ 2.4)
Account Lockouts
Unexpected account lockouts caused by repeated failed logins, often indicating credential theft attempts, brute-force activity, or malware-driven account abuse.
Concurrent Session Utilization
A condition where one user account shows multiple simultaneous sessions, which may indicate hijacked access or malware-enabled misuse.
Blocked Content
A surge in blocked files, links, or other content detected by security tools, suggesting attempted or active malware-related activity.
Impossible Travel
A condition where the same user account appears to access systems from geographically distant locations in an unrealistically short time.
Resource Consumption
Abnormal use of CPU, memory, or network bandwidth caused by malware such as cryptominers, botnets, or worms.
Resource Inaccessibility
A state where files, systems, or services become unavailable, often because ransomware has encrypted or disrupted access to them.
Out-of-Cycle Logging
Log activity occurring at unusual times or outside expected business or operational patterns.
Missing Logs
Absent, cleared, or deleted log records that may indicate an attacker is trying to hide evidence of compromise.
Published or Documented Attack
An externally reported or publicly documented incident showing that an organization has been affected by a malware campaign or related compromise.
9 malware indicators
Common signs of possible malware activity include:
- Account lockouts: repeated failed logins trigger user lockouts, often signaling credential attacks
- Concurrent session utilization: one account shows multiple simultaneous sessions, suggesting hijacked access
- Blocked content: security tools suddenly block more files or links, indicating malware-related activity
- Impossible travel: the same account appears in distant places too quickly to be legitimate
- Resource consumption: unusual CPU, memory, or bandwidth spikes may reflect malware execution
- Resource inaccessibility: files or systems become unavailable, often due to ransomware encryption
- Out-of-cycle logging: logs appear at unusual times that do not match expected operations
- Missing logs: logs are deleted or absent, suggesting concealment after compromise
- Published or documented attacks: outside reporting confirms the organization is part of a malware campaign
Account and session anomalies can signal compromise
Several indicators revolve around stolen credentials or unauthorized account use.
- Unexpected account lockouts may reflect brute-force or credential abuse
- Concurrent sessions on one account may indicate hijacked access
- Impossible travel often points to credential theft after compromise
Performance and access symptoms can reveal active malware
system degradation and loss of access to malware behavior.
- High CPU, memory, or bandwidth use may indicate cryptominers, botnets, or worms
- System slowdowns can make resource abuse noticeable
- Inaccessible files or ransom messages strongly indicate ransomware
Log irregularities are high-value detection signals
Unexpected or missing logs often reveal attacker activity or concealment attempts.
- Out-of-cycle logs may show unauthorized activity at unusual hours
- Missing logs may mean an attacker deleted evidence
- Regular log review is necessary to catch subtle malware indicators
Many users suddenly locked out without normal password mistakes -> Account lockout indicator
Scenario shows a surge in account lockouts without a benign explanation -> identify this as a sign of possible malware-related credential attack activity.
Same user account active in distant locations too quickly -> Impossible travel
If one account appears in two far-apart places within an unrealistic time window, classify it as impossible travel and suspect account compromise.
Files become inaccessible and payment is demanded -> Ransomware indicator
Scenario includes encrypted files, inaccessible systems, or decryption payment demands -> identify a ransomware-based malware attack.
Logs disappear or appear at unusual hours -> Malware concealment or unauthorized activity
If logs are missing, cleared, or generated outside expected operating times, treat it as a strong indicator of malicious activity.