A parks IT ticket shows malware copying itself across shared drives to new hosts, unlike a single-host trojan planted once by a user. Which distinction should the SOC emphasize?
Select an answer to reveal the explanation.
Short Explanation
Worms photocopy themselves across the network; trojans wait for someone to invite them in once. Parks SOC calling out lateral copy versus single-host drop is taxonomy that matters for blast radius. Don’t mash every sample into ‘ransomware’ and call it a day.
Full Explanation
Propagation style is a core malware taxonomy axis. When parks IT observes malware copying itself across shared drives to new hosts, that self-propagating, worm-like spread differs from a non-spreading single-host trojan model that typically relies on user-assisted installation once and does not autonomously replicate across file shares. Municipal parks estates with broad shared drives are especially sensitive to worm-like copy behavior; emphasizing the distinction drives containment scope, share permission review, and user messaging that match blast radius rather than treating every sample as identical ransomware.
Claiming both models are identical because any malware on parks PCs is ransomware fails: ransomware is an objective/impact class, not a substitute for propagation taxonomy, and not every parks infection is ransomware. Saying the difference is only whether AI wrote the sample fails because authorship tooling is irrelevant to worm-like spread versus single-host trojan installation. Asserting trojans always use USB while worms always use deepfake video is false taxonomy; media and deepfakes are not definitional requirements for those malware models.
Exam caveat: trojan vs worm (user-assisted vs self-propagating) is classic fundamentals. Do not collapse taxonomy into ‘everything is ransomware’ when the stem highlights copy-across-shares behavior.
Operational check for parks SOC: disable or tightly control write access on implicated shares, hunt for identical binaries/hashes across park PCs, isolate newly infected hosts, reset credentials if share-authenticated spread is suspected, and communicate that opening a share-copied executable is part of the problem—containment must address both hosts and the shared-drive vector.