312-50 Question 179
Single answer▪ Anti-Malware SoftwareDuring an internal security assessment, you are asked to evaluate whether the organization’s anti-malware controls can detect modern fileless attacks on Windows 10 endpoints. You execute a controlled PowerShell-based payload that runs only in memory, uses obfuscated commands, and does not drop a traditional executable to disk. Signature-based antivirus on several hosts does not generate an alert, but the EDR/anti-malware platform on one pilot group blocks the activity after PowerShell starts spawning suspicious child processes. Which anti-malware capability most directly explains why the pilot group detected the attack while the signature-only systems did not?
- A
Behavior-based detection that monitors process activity and suspicious execution patterns
- B
Hash-based allowlisting that compares the payload against known malicious file hashes on disk
- C
Email attachment filtering that removes known malware before delivery to the endpoint
- D
Full-disk encryption that prevents unauthorized access to malware signatures stored locally
Show answer and explanation
Correct answer: A
Explanation
The best answer is behavior-based detection. Fileless malware and living-off-the-land techniques often abuse trusted tools such as PowerShell, WMI, rundll32, or mshta, specifically to evade traditional signature-based antivirus that focuses on known malicious files. Modern anti-malware and EDR products improve detection by using heuristics, behavioral analytics, AMSI-integrated script inspection, process monitoring, and attack surface reduction policies. Microsoft and other endpoint security vendors document that fileless and script-based threats are often identified through behavioral monitoring, suspicious command-line analysis, and memory-based detections rather than static file signatures alone. From a CEH perspective, this question tests whether the candidate understands the operational difference between legacy signature-only antivirus and modern anti-malware/EDR capabilities in realistic enterprise environments.
- A. Correct.
Correct. Behavior-based detection is designed to identify malicious actions rather than relying only on known file signatures. In this scenario, the payload is fileless, memory-resident, and launched through PowerShell with obfuscation. Modern anti-malware and EDR tools commonly detect such activity by monitoring process chains, script execution, command-line behavior, parent-child relationships, memory abuse, and other indicators of compromise. Blocking after PowerShell spawned suspicious child processes is a classic example of behavioral or heuristic detection working where simple signature matching fails.
- B. Incorrect.
Incorrect. Hash-based allowlisting or blacklisting depends on a file artifact that can be hashed and compared against a known database. The scenario explicitly states that the attack did not drop a traditional executable to disk, so there may be no stable file hash to evaluate. Even if a script or loader were present, obfuscation and in-memory execution reduce the usefulness of file-hash-based detection for this type of attack.
- C. Incorrect.
Incorrect. Email attachment filtering is a preventive control at the mail gateway or endpoint mail client level, but it does not explain why the malicious behavior was detected after PowerShell began executing suspicious actions on the host. The scenario is about endpoint detection of a running fileless payload, not pre-delivery filtering of an attachment.
- D. Incorrect.
Incorrect. Full-disk encryption protects data at rest and helps preserve confidentiality if a device is lost or stolen. It is not an anti-malware detection capability and does not improve the ability to identify obfuscated, memory-only PowerShell attacks. A candidate might choose this option by confusing general endpoint security controls with malware detection mechanisms.