312-50 Question 178
Single answer▪ Anti-Malware SoftwareDuring an internal security assessment, you are asked to evaluate why several Windows endpoints were infected by a newly emerged downloader malware despite having anti-malware software installed. The SOC reports that the malware used a heavily obfuscated PowerShell script delivered through a phishing attachment, and infection occurred before a signature update was available. Which anti-malware capability would have been MOST effective at preventing the initial execution of this threat?
- A
Signature-based detection using the latest downloaded malware definitions
- B
Heuristic/behavior-based detection that monitors suspicious script execution patterns
- C
A weekly full-disk scan scheduled outside business hours
- D
Quarantining only files with known malicious hashes from the vendor's blacklist
Show answer and explanation
Correct answer: B
Explanation
The best answer is heuristic/behavior-based detection because the key issue is that the malware was new and executed before signatures were updated. Modern anti-malware solutions do more than compare files against known signatures; they also use heuristics, machine learning, exploit protection, AMSI-integrated script inspection on Windows, and behavior monitoring to detect suspicious actions such as encoded PowerShell, LOLBins, unusual parent-child process relationships, persistence creation, and outbound command-and-control traffic. Microsoft security guidance and major endpoint protection vendors consistently recommend behavior-based and real-time protection layers because script-based and fileless attacks often bypass traditional signature-only defenses. In practical CEH scenarios, candidates should recognize that signature scanning is necessary but insufficient by itself against zero-day, polymorphic, or obfuscated malware.
- A. Incorrect.
Incorrect. Signature-based detection is effective against known malware, but the scenario states the infection happened before a signature update was available. That means relying primarily on downloaded definitions would likely miss a newly emerged and obfuscated threat at initial execution.
- B. Correct.
Correct. Heuristic and behavior-based detection is designed to identify suspicious activity even when a specific signature does not yet exist. In this scenario, heavily obfuscated PowerShell launching a downloader is a classic case where anti-malware engines, EDR, or endpoint protection products use behavioral indicators such as unusual script interpreter activity, encoded commands, child-process spawning, persistence attempts, or network beacons to block execution.
- C. Incorrect.
Incorrect. A weekly full-disk scan may discover malware after compromise, but it is not the most effective control for preventing the initial execution of a phishing-delivered script-based attack. Scheduled scanning improves detection coverage but does not address real-time prevention against fileless or script-based threats.
- D. Incorrect.
Incorrect. Hash-based blocking works only for previously identified malware samples with exact matches. Attackers frequently change file content or use script obfuscation to alter hashes, making this approach weak against new or polymorphic malware. It would not be the most effective preventive capability in the described situation.