Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
Malware attacks
analyze indicators of malicious activity
| Question | Answer |
|---|---|
| malware | any software that is designed to infiltrate a computer system without the user's knowledge |
| threat vector | specific method used by an attacker to infiltrate a victim's machine. Break into the system. |
| threat vector examples | unpatched software, installing code, phishing campaign, other vulnerabilities |
| attack vector | an attacker gains access to a computer to infect the system with malware. Breaks into and infects the system. |
| virus | malicious software that attaches to clean files and spreads into a computer system |
| worms | standalone malware programs that replicate and spread to other systems by exploiting software vulnerabilities |
| Trojans | |
| computer virus | malicious code that's run on a machine without the user's knowledge and this allows the code to infect the computer whenever it has been run |
| Identify 10 different types of viruses | boot sector, macro, program, multipartite, encrypted, metamorhpic, polymorhipc, armor, hoax, stealth |
| Boot Sector device | Stored in the first sector of a hard drive and is then loaded into memory whenever the computer up. To find and remove these viruses, use an antivirus that specifically looks for boot sector viruses |
| macro virus | A form of code that allows a virus to be embedded inside another document so that when that document is open by the User, the virus is executed |
| program virus | Tries to find executable or application files to infect with their malicious code |
| multipartite virus | A combination of a boot sector type virus and a program virus |
| encrypted virus | designed to hide itself from being detected by encrypting its malicious code or payloads to avoid detection by any antivirus software |
| polymorphic virus | advanced version of an encrypted virus, but instead of just encrypting the contents, it will actually change the virus's code each time it is executed by altering the decryption module in order for it to evade detection |
| metamorphic virus | able to rewrite itself entirely before it attempts to infect a given file |
| stealth virus | Not necessarily a specific type of virus as much as it is a technique used to prevent the virus from being detected by the antivirus software |
| armored virus | Have a layer of protection to confuse a program or a person who's trying to analyze it |
| hoax | A form of technical social engineering that attempts to scare end users into taking undesirable action on their system |
| Worm | Piece of malicious software, much like a virus, but it can replicate itself without any User interaction. Can infect the workstation and other computing assets. Can cause disruption to the normal network traffic since they are constantly trying to replic8 |
| trojan | A piece of malicious software that is disguised as a piece of harmless or desirable software |
| Remote access trojan (RAT) | Type of Trojan that is widely used by modern attackers because it provides the attacker with remote control of a victim machine |
| ransomware | Type of malicious software that is designed to block access to a computer system or it's data by encrypting get into a ransom is paid to the attacker |
| ransomware what to do | never pay the ransom, disconnect the infected system from the network, notify the authorities, restore the data from known good backups |
| botnet | network of compromised computers or devices controlled remotely by malicious actors |
| Zombie | Name of a compromised computer or device that is part of a botnet and used to perform task using remote command commands |
| command and control node | responsible for managing and coordinating the activities of other nodes or device within a network |
| Rootkit | Type of software that is designed to gain administrative level control over a given computer system without being detected |
| kernel mode | allows a system to control access to things like device drivers, sound card, and monitor |
| DLL injection | technique used to run arbitrary code within the address space of another process by forcing it to load a dynamic-link library |
| shim | software code that is placed between two components |
| backdoor | used to bypass the normal security and authentication functions |
| easter egg | insecure coding practice that was used by programmers to provide a joke or a gag gift to the users |
| logic bomb | malicious code that's inserted into a program, and will only execute when certain conditions have been met |
| keylogger | piece of software or hardware that records every single keystroke that is made on a computer or mobile device |
| what can keylogger lead to? | identity theft, financial fraud, corporate espionage |
| spyware | type of malicious software that is designed to gather and send information about a user or organization |
| how is spyware installed? | bundled with other software, installed through a malicious website, installed when users click on a deceptive pop-up advertisement |
| bloatware | any software that comes pre-installed on a new computer or smartphone. Microsoft products. Waste storage space, slows down the performance of devices |
| how to remove bloatware? | manually remove it, use bloatware remove tools, perform a clean OS installation |
| exploit technique | describes the specific method by which malware code infects a target host |
| fileless malware | used to create a process in the system memory without relying on the local file system of the infected host |
| dropper | initiates or runs other malware forms within a payload on an infected host |
| downloader | retrieves additional tools post the initial infection facilitated by a dropper |
| shellcode | encompasses lightweight code meant to execute an exploit on a given target |
| concealment | used to help the threat actor prolong unauthorized access to a system by hiding tracks, erasing log files, and hiding any evidence of malicious activities |
| "living off the land" | a strategy adopted by many Advanced Persistent Threats and Criminal organizations |
| common indicators of malware | account lockouts, concurrent session utilization, blocked content, impossible travel, resource consumption, resource inaccessibility, out-of-cycle logging, missing logs, published or documented attacks |
Created by:
user-2044395