1.2 Given a scenario, analyze potential indicators to determine the type of attack Flashcards
What is Malware?
The term malware describes a wide range of software that is intentionally designed to cause harm to systems and devices, networks, or users.
Malware can also gather information, provide illicit access, and take a broad range of actions that the legitimate owner of the system or network may not want to occur.
Ransomware (Malware)
Ransomware is malware that takes over a computer and then demands a ransom.
One of the most important defenses against ransomware is an effective backup system that stores files in a separate location that will not be impacted if the system or device it backs up is infected and encrypted with ransomware.
Trojans (Malware)
Trojans or Trojan horses, are a type of malware that is typically disguised as legitimate software.
They are called Trojan horses because they rely on unsuspecting individuals running them, thus providing attackers with a path into a system or device.
Worms (Malware)
Unlike Trojans that require user interaction, worms spread themselves. Although worms are often associated with spreading via attacks on vulnerable services, any type of spread through automated means is possible.
Worms also self-install, rather than requiring users to click on them.
Potentially unwanted programs (PUPs)
(Malware type)
Potentially unwanted programs or PUPs are programs that may not be wanted by the user but are not as dangerous as other types of malware. PUPs are typically installed without the user’s awareness or as part of a software bundle or other installation.
Potentially unwanted programs can be detected and removed by most anti-malware and anti-virus programs, and organizations may limit user rights to prevent installation of additional software or to limit which software can be installed to prevent installation of PUPs and other unwanted apps on their organizationally owned device.
Fileless virus (Malware type)
Fileless virus attacks are similar to traditional viruses in a number of critical ways. They spread via methods like spam email and malicious websites, and they exploit flaws in browser plug-ins and web browsers themselves.
Once they have successfully find a way into a system, they inject themselves into memory and conduct further malicious activity, including adding the ability to reinfect the system by the same process at reboot through a registry entry or other technique.
Command and Control (Malware)
A computer controlled by an attacker or cyber criminal which is used to send commands to systems compromised by malware and receive stolen data from a target network.
C&C servers are the core of a botnet. They allow attackers to manage the botnet, and advanced C&C tools have a broad range of capabilities that can help attackers steal data, conduct DDoS attacks on massive scale, deploy and update additional malware capabilities, and respond to attempts by defenders to protect their networks.
Bots (Malware)
Bots are remotely controlled systems or devices that have a malware infection.
Groups of bots are known as botnet, and botnet are used by attackers who control them to perform various actions.
Cryptomalware (Malware type)
Cryptomalware, which encrypts files and then holds them hostage until a ransom is paid.
Logic bombs (Malware)
Logic bombs, unlike the other types of malware described here, are not independent malicious programs. Instead, they are functions or code that are placed inside other programs that will activate when set conditions are met.
Some malware uses this type of code to activate when a specific date or set condition is met.
Spyware (Malware type)
Spyware is malware that is designed to obtain information about an individual, organization or system.
Many spyware packages track users browsing habits, installed software, or similar information and report it back to central servers.
Spyware is most frequently combated using anti malware tools or user awareness.
Keyloggers (Malware type)
Keyloggers are programs that capture keystrokes, although keylogger applications may also capture other input like mouse movement, touchscreen inputs, or credit card swipes from attached devices.
Best practice for prevention is to ensure that malware containing keylogger is not installed, including patching and systems management, as well as use of anti malware tools
MFA can help limit the impact of keylogger, even if it can’t defeat the key logger itself.
Remote access Trojan (RAT)
(Malware type)
RAT provide attackers with remote access to systems.
Security awareness and anti malware tools help combat RATs
Rootkit (Malware)
Rootkits are malware that is specifically designed to allow attackers to access a system through a backdoor.
Many modern rootkits also include capabilities that work to conceal the rootkit from detection through any of a variety of techniques, ranging from leveraging filesystem drivers to ensure that users cannot see the rootkit files, to infecting startup code in the master boot record (MBR) of a disk, thus allowing attacks against full-disk encryption systems.
Backdoor (Malware type)
Backdoors are methods or tools that provide access that bypass normal authentication and authorization procedures, allowing attackers access to systems, devices, or applications.
Detecting backdoors can sometimes be done by checking for unexpected open ports and services, but more complex backdoor tools may leverage existing services.
