300-215 Question 69
Select 4During an investigation, a cybersecurity analyst suspects that a system is compromised with fileless malware. Using Cisco Secure Endpoint and following the MITRE ATT&CK framework, which methods can be applied to detect and analyze fileless malware activity?
- A
Monitor process injection activities using endpoint telemetry
- B
Perform memory analysis to identify anomalous processes and injected code
- C
Analyze traditional file-based malware signatures in antivirus logs
- D
Inspect scheduled tasks and registry keys for persistence mechanisms
- E
Use dynamic malware analysis tools to execute the suspected binary in a sandbox
- F
Examine system event logs for unusual PowerShell or script-based activity
Show answer and explanation
Correct answers: A, B, D, F
Explanation
Fileless malware does not rely on traditional executable files, often operating directly in memory or through trusted system processes. The MITRE ATT&CK framework outlines techniques for detecting such threats, including monitoring process injection, memory analysis, inspecting persistence mechanisms like registry keys and scheduled tasks, and analyzing unusual script-based activities in logs. Cisco Secure Endpoint provides visibility into these behaviors, enabling effective detection and response.
- A. Correct.
Monitoring process injection activities can help identify malicious behavior indicative of fileless malware, as these often involve injecting code into legitimate processes.
- B. Correct.
Memory analysis is critical for identifying fileless malware, as it does not leave traditional file-based artifacts and resides in memory.
- C. Incorrect.
Traditional file-based malware signatures are ineffective against fileless malware since it does not rely on files stored on disk.
- D. Correct.
Fileless malware often establishes persistence by modifying scheduled tasks or registry keys, making it essential to inspect these areas.
- E. Incorrect.
Dynamic malware analysis tools are typically used for file-based malware and may not effectively analyze fileless malware, which operates without a binary.
- F. Correct.
Unusual PowerShell or script-based activity is a common indicator of fileless malware, making system event log analysis a key detection method.