Malware Flashcards
What is malware?
Malicious software designed to infiltrate computer systems and potentially damage them without user consent
Malware can take various forms and is categorized into types such as viruses, worms, and ransomware.
Name three categories of malware.
- Viruses
- Worms
- Ransomware
What is a threat vector?
Method used to infiltrate a victim’s machine
Examples include unpatched software and phishing campaigns.
What is an attack vector?
Means by which the attacker gains access and infects the system
It combines both the infiltration method and the infection process.
What are the characteristics of viruses?
Attach to clean files, spread, and corrupt host files
Describe worms.
Standalone programs replicating and spreading to other computers
What defines a Trojan?
Disguises as legitimate software, granting unauthorized access
What is ransomware?
Encrypts user data, demands ransom for decryption
What are zombies and botnets?
Compromised computers remotely controlled in a network for malicious purposes
Define rootkits.
Hide presence and activities on a computer, operate at the OS level
What are backdoors?
Allow unauthorized access to a system
What is a logic bomb?
Malicious code that executes when certain conditions are met
What is a keylogger?
Records keystrokes, captures passwords or sensitive information
How does spyware function?
Monitors and gathers user/system information
What is bloatware?
Software that comes pre-installed on devices that users did not specifically request
Fill in the blank: A _______ is a piece of malicious software that can replicate itself without user interaction.
worm
True or False: Ransomware guarantees data recovery if the ransom is paid.
False
What is a botnet?
Network of compromised computers or devices controlled remotely by malicious actors
What is a command and control node?
Computer responsible for managing and coordinating activities of other nodes within a network
What is the purpose of a rootkit?
Gain administrative level control over a computer system without being detected
What is DLL injection?
Technique used to run arbitrary code within the address space of another process
What is a stage one dropper?
Piece of malware created as a lightweight shellcode that can be executed on a system
What does ‘living off the land’ mean in cybersecurity?
Exploiting standard tools to perform intrusions
What are common indicators of malware attacks? Name two.
- Account lockouts
- Concurrent session utilization
What is a common indicator of malware attacks related to user accounts?
Account Lockouts
Malware designed for credential theft or brute force attacks can trigger multiple failed login attempts resulting in account lockouts.
What does Concurrent Session Utilization indicate in malware detection?
Multiple simultaneous or concurrent sessions from various geographic locations for a single user account
This may suggest unauthorized access to the account.
What does an increase in Blocked Content alerts signify?
A sudden increase in blocked content alerts from security tools
This may indicate potential malware activity or attempts to access restricted content.
Define Impossible Travel in the context of malware attacks.
Accessing a user’s account from geographically separated locations in an impossibly short period of time
This scenario suggests that the account may have been compromised.
What is Resource Consumption in relation to malware indicators?
Unusual spikes in CPU, memory, or network bandwidth utilization not linked to legitimate tasks
Such spikes may indicate malware activity consuming system resources.
What is Ransomware?
A form of malware that encrypts user files to make them inaccessible
Ransomware may demand payment to decrypt the affected data.
What does Resource Inaccessibility indicate?
A large number of files or critical systems suddenly becoming inaccessible
Users may receive messages demanding payment to regain access.
What does Out-of-Cycle Logging suggest in malware detection?
Logs generated at odd hours or during times with no legitimate activities
This may indicate unauthorized access or activities occurring outside normal operating hours.
What does Missing Logs indicate during a log review?
Gaps in logs or cleared logs without authorized reason
This may suggest tampering or an attempt to hide malicious activities.
What does Published or Documented Attacks refer to?
Reports showing that an organization’s network has been infected as part of a botnet or malware-based attack
This information can be critical for assessing the security posture of an organization.
