Malware Fundamentals

GOAA · 20 questions

• A city SOC reviews a malicious Word macro on a permitting workstation that writes a second-stage binary to disk before launching it. Which malware role best matches that behavior?
• A county IR team finds that a clerk PC was compromised through a browser vulnerability, after which a remote-access tool ran. How should they separate those two concepts?
• A transit malware investigation shows the sample spread when technicians reused an infected USB stick for bus-garage diagnostic laptops. Which concept does that illustrate?
• A water-utility alert shows malware that performs environment checks and only then retrieves a final tool from the network. Which malware stage best describes that sample?
• A school-district forensics note lists new scheduled tasks and HKCU Run keys on a compromised lab host. Which malware fundamental do those findings primarily demonstrate?
• A housing-authority reverse engineer observes a lab sample that detects a debugger and immediately exits before revealing useful strings. Which category best fits that behavior?
• A fusion-center brief tells analysts that packing and string encryption hide indicators from scanners but do not themselves exploit a new vulnerability. How should the brief classify those techniques?
• A parks IT ticket shows malware copying itself across shared drives to new hosts, unlike a single-host trojan planted once by a user. Which distinction should the SOC emphasize?
• A public-health endpoint investigation finds malicious code executing primarily from memory after a user clicked a malicious link, with little lasting on disk. Which characteristic does that highlight?
• A city malware taxonomy chart for new SOC analysts sequences classic delivery stages. Which order correctly reflects dropper, downloader, and payload roles?
• A county detection rule fires on unusual Windows service creation on a finance workstation days after the phishing email was deleted. Which kill-chain concept does the rule primarily target?
• A transit IR playbook lists sandbox evasion and VM artifact checks under one heading and beaconing to a controller under another. How should analysts categorize sandbox evasion?
• A municipal malware lab notes a sample consistent with process hollowing concepts used to run code under a legitimate process image. Without rewriting code, what anti-detection goal should analysts document?
• A court workstation incident involved a fake invoice attachment; after opening it, a remote-access tool executed. Which role separation is most accurate?
• A water SCADA-adjacent Windows jump box investigation finds persistence achieved through DLL search-order abuse. How should the report tag that finding?
• A school SOC trainer tells staff that an ‘exploit’ takes advantage of a vulnerability while a ‘payload’ is what runs afterward. Which statement best reinforces that teaching point?
• A city threat hunt observes a downloader beaconing and retrieving modules days before any encryption activity appears. What malware-fundamentals insight should hunters emphasize?
• A county purple team prepares a municipal attack-surface brief on how malware commonly arrives. Which set best represents common propagation vectors they should map?
• An emergency-operations Windows host shows persistence implemented through WMI event subscriptions. How should IR classify that mechanism?
• A housing SOC glossary draft must distinguish techniques that hide from antivirus from techniques that frustrate reverse engineers. Which distinction belongs in the glossary?