300-215 Question 70
Select 3While investigating a suspected fileless malware attack, you are tasked with using the MITRE ATT&CK framework to identify techniques for analyzing the threat. Which of the following methods should you consider for analyzing fileless malware activity on a compromised system?
- A
Inspecting process injection patterns to identify malicious behavior within legitimate processes
- B
Monitoring command-line arguments for suspicious activity patterns
- C
Performing signature-based antivirus scanning of system files
- D
Analyzing Windows Registry for unusual persistence mechanisms
- E
Capturing full disk images for offline analysis
Show answer and explanation
Correct answers: A, B, D
Explanation
Fileless malware typically avoids traditional file-based detection methods by operating in-memory and leveraging system tools like the Windows Registry, command-line interfaces, and process injection. The MITRE ATT&CK framework highlights techniques such as process injection, command-line monitoring, and registry analysis as effective methods for identifying and analyzing fileless malware. Traditional methods like signature-based antivirus scanning and full disk imaging are less effective in these scenarios.
- A. Correct.
Correct: Process injection is a common technique used by fileless malware to hide malicious code within legitimate processes, which is identified in the MITRE ATT&CK framework.
- B. Correct.
Correct: Monitoring command-line arguments can reveal fileless malware execution patterns, as these threats often rely on commands to execute malicious activities without creating traditional files.
- C. Incorrect.
Incorrect: Signature-based antivirus scanning is ineffective for fileless malware because it typically operates in-memory and avoids creating detectable files.
- D. Correct.
Correct: Fileless malware often uses unusual or malicious persistence mechanisms within the Windows Registry, making it a crucial source for forensic analysis.
- E. Incorrect.
Incorrect: Capturing full disk images is useful for traditional malware analysis but may not be effective for fileless malware, as it operates in-memory and may not leave disk artifacts.