Lesson 8C Troubleshoot Workstation Security Issue Flashcards
Malware Vectors
The vector is the method by which the malware executes on a computer and potentially spreads to other network hosts.
Viruses
Malicious code inserted into an executable file image. The malicious code is executed when the file is run and can deliver a payload, such as attempting to infect other files.
.EXE, .MSI, .DLL, .COM, .SCR, and .JAR.
Boot Sector Virus
These infect the boot sector code or partition table on a disk drive. When the disk is attached to a computer, the virus attempts to hijack the bootloader process to load itself into memory.
Trojans
Malicious software program hidden within an innocuous-seeming piece of software. Usually, the Trojan is used to try to compromise the security of the target computer.
Worms
Type of malware that replicates between processes in system memory and can spread over client/server network connections.
Fileless Malware
Exploit techniques that use the host’s scripting environment to create malicious processes.
Malware Payload
Backdoors
Also referred to as a Remote Access Trojan, allows a threat actor to access and control the infected host.
Command and Control
Infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets.
Spyware
Can perform browsing reconfiguration, such as allowing tracking cookies, changing default search providers, opening arbitrary pages at startup, adding bookmarks and so on. Take screenshots, activate recording devices.
Keylogger
Records a user keystrokes in order to attempt to steal sensitive information.
Rootkit
Class of malware that modifies system files, often at the kernel level, to conceal its presence.
Ransomware
Malware that tries to extort money from the victim by blocking normal operation of a computer and/or encrypting the victim’s files and demanding payment.
Cryptomining
hijacks the resources of the host to perform cryptocurrency mining.
Troubleshoot Desktop Symptoms
Any type of activity or configuration change that was not initiated by the user is a good reason to raise suspicion.
