Lesson 13 - Group 1: Malware and Malicious Activity Indicators

Virus

Malware that relies on a host file or media-delivery vector and spreads within code without authorization.

What virus types are listed in Lesson 13?

Non-resident or file infector, memory resident, boot, and script or macro viruses.

Worm

Malware that propagates through memory or network links and may consume bandwidth or crash processes.

Trojan

A malicious program concealed within an apparently benign program.

PUP or PUA

A potentially unwanted program or application, such as bloatware or software installed alongside another application; also called grayware.

Fileless malware

Malware that uses remote execution, memory residence, scripts, the registry, shellcode, or built-in tools rather than relying primarily on files stored on disk.

Living off the land

Abusing legitimate built-in scripting tools or system utilities to perform malicious activity.

What persistence mechanism is associated with fileless malware in Lesson 13?

Registry-based persistence.

Adware

A potentially unwanted program that displays advertising or changes browser settings.

Spyware

Malware that monitors local activity, records information, captures screenshots, or redirects activity.

Keylogger

Software or hardware that records keystrokes.

Backdoor

A method of bypassing normal access controls, created by malware, misconfiguration, or unauthorized software.

RAT

Remote Access Trojan; malware that gives an attacker remote control of a compromised system.

Botnet

A group of compromised hosts controlled through a command-and-control network.

C2 or C&C

Command and control communication used to direct compromised systems.

Rootkit

Malware designed to maintain privileged and concealed access by modifying system files, utilities, logs, or firmware.

What rootkit indicators are listed?

Replacement of key system files, purged logs, SYSTEM or root-level activity, and firmware compromise.

Ransomware

Malware that locks a user out of a system or demands payment to restore access.

Crypto-malware

High-impact ransomware that encrypts data files or storage devices.

Cryptojacking

Unauthorized use of system resources to mine cryptocurrency.

Logic bomb

Malicious code designed to activate when a specified condition is met.

TTP

Tactics, Techniques, and Procedures used by a threat actor.

IoC

Indicator of Compromise; evidence suggesting that malicious activity or compromise occurred.

What framework documents attacker TTPs and IoCs?

MITRE ATT&CK.

What general malware indicators are listed in Lesson 13?

Browser changes, ransomware notifications, suspicious sandbox behavior, high resource consumption, blocked or inaccessible files, account compromise, and missing or out-of-cycle log