A public-health SOC updates its municipal taxonomy for anti-detection techniques. How should memory-only loaders be classified?
Select an answer to reveal the explanation.
Short Explanation
Memory-only loaders are the 'leave no sticky note on the desk' trick—less for disk scanners to grab. Public-health SOC taxonomy should tag them as anti-disk-detection, not as patch or email policy trivia.
Full Explanation
Public-health SOC taxonomies for anti-detection techniques should place memory-only loaders under anti-disk-detection (fileless or in-memory execution) tradecraft. These loaders favor executing payloads in memory rather than writing clear artifacts to disk, reducing opportunities for on-disk AV signature hits, simple file-integrity monitors, and forensic collection that starts from filesystem enumeration. Correct classification drives hunt design: memory scanners, script-block logging, process injection indicators, and volatile artifact capture become primary—not only disk hash matching.
Memory-only loaders are not patch-management scheduling methods, network bandwidth optimizations, or email retention policy controls. Those distractors misuse familiar IT vocabulary and fail the anti-detection taxonomy purpose of the public-health SOC update.
Exam caveat: classify by defensive bypass intent—avoiding clear disk payloads—not by unrelated municipal IT functions that happen to use the word 'policy' or 'optimization.'
Operational check: when updating the municipal taxonomy, add memory-only/fileless as an anti-disk-detection class with example telemetry sources (EDR memory anomalies, unusual RWX allocations, reflective load patterns). Train analysts to request memory evidence early on public-health endpoints when disk scans are clean but behavior is suspicious.