Section 6.57 Malware Attack Techniques

Question 1

Method of attack: Think modern

Malware Attack Techniques

Answer 1

The specific method by which malware code penetrates and infects a targeted system

■ Most modern malware uses fileless techniques to avoid detection from signature-based security software.
■ Fileless malware infects the systems memory (RAM) to avoid detection and to execute its malicious code using trusted tools directly from memory.

PowerShell exploitation: PowerShell is commonly exploited by fileless malware for its ability to execute complex operations without generating executable files. Usually, it’s leveraged to download and run payloads directly from memory and bypass scripting restrictions.

Question 2

Stage 1 Dropper or Downloader

Answer 2

When a user accidentally clicks on a malicious link or opens a malicious file, the specific type of malware being installed is known as a Stage One Dropper or Downloader.

The primary function of a stage one dropper or downloader is to retrieve additional portions of the malware code and to trick the user into activating it

This Piece of malware is usually created as a lightweight shellcode that can be executed on a given system

Question 3

Dropper

Answer 3

Specific malware type designed to initiate or run other malware forms within a payload on an infected host

Question 4

Downloader

Answer 4

Retrieve additional tools after the initial infection completed by the Dropper

Question 5

Shellcode

Answer 5

Lightweight code meant to execute an exploit on a given target

Question 6

Stage 2: Downloader

Answer 6

Downloads and installs a remote access Trojan to conduct command and control on the victimised system

Question 7

“Actions on Objectives” Phase

Answer 7

Threat actors will execute primary objectives to meet core objectives like

■ Data exfiltration
■ File encryption

Question 8

Concealment

Answer 8

Used to help the threat actor prolong unauthorised access to a system by

■ Hiding tracks
■ Erasing log files
■ Hiding any evidence of malicious activity

Question 9

“Living off the Land”

Answer 9

■ A strategy adopted by many Advanced Persistent Threats and criminal organizations

■ The threat actors try to exploit the standard tools to perform intrusions