46. Malware

Malware

Any software that is designed to infiltrate a computer system without the user’s knowledge

Malware needs

A threat vector and an attack vector

Threat Vector

Specific method used by an attacker to infiltrate a victim’s machine

Threat Vector Examples

Unpatched software

Installing code

Phishing campaign

Other vulnerabilities

Attack Vector

A means by which an attacker gains access to a computer to infect the system with malware; Essentially how a vulnerability is actually exploited

Viruses

Malicious software that attaches to clean files and spreads into a computer system

Worms

Standalone malware programs that replicate and spread to other systems by exploiting software vulnerabilities

Trojans

Malicious programs which appear to be legitimate software that allows unauthorized access to a victim's system when executed

Ransomware

Encrypts a user's data and holds it hostage until a ransom is paid to the attacker for decryption

Zombies

Compromised computers that are remotely controlled by attackers and used in coordination to form a botnet

Botnets

Network of zombies and are often used for DDoS attacks, spam distribution, or cryptocurrency mining

Rootkits

Malicious tools that hide their activities and operate at the OS level to allow for ongoing privileged access

Backdoors

Malicious means of bypassing normal authentication processes to gain unauthorized access to a system

Logic Bombs

Embed code placed in legitimate programs that executes a malicious action when a specific condition or trigger occurs

Keylogger

Record a user's keystrokes and are used to capture passwords or other sensitive information

Spyware

Secretly monitors and gathers user information or activities and sends data to third parties

Bloatware

Unnecessary or pre-installed software that consumes system resources and space without offering any value to the user

Malware Attack Techniques

Involve methods by which malware infiltrates and infects targeted systems

Indications of Malware Attacks

Account Lockouts

Concurrent session utilization

Blocked content

Impossible travel

Resource consumption

Resource inaccessibility

Out-of-cycle logging

Missing logs

Published or documented attacks