Recognising malware by the evidence it leaves

Objective 2.4 in this course covers malicious activity — CompTIA's scope note for it analyses malware attacks, password attacks, application attacks, physical attacks, network attacks and cryptographic attacks. Note the verb: analysing indicators. This lesson takes malware, and it is written the way the objective is scoped — what the evidence looks like and what stops it, not how to build any of it.

Why this matters

This is the largest objective in Domain 2 and it is examined as recognition. You are given symptoms — a user reports something, a log shows something, a scan returns something — and asked what it indicates. Getting fast at that is worth more marks here than in almost any other objective.

The trap is that several malware types produce overlapping symptoms, so the distinguishing detail matters. "Files are encrypted" is not enough to separate ransomware from a wiper pretending to be ransomware, and "the machine is slow" describes half this list.

The lesson

Ransomware, trojan, worm, virus, rootkit and the differences that matter

• Virus — attaches itself to a file or program and requires a user action to execute and spread. The defining feature is that it needs a host and a human.
• Worm — self-propagating. It spreads across a network without user action, typically by exploiting a service vulnerability. The defining feature is autonomous spread, which is why worms produce sudden simultaneous infections across many hosts and why segmentation and patching are their controls.
• Trojan — appears to be something legitimate and desirable. It does not self-propagate; it relies on the user installing it. A remote access trojan (RAT) additionally gives the attacker interactive control.
• Ransomware — denies access to data, usually by encrypting it, and demands payment. Modern variants also exfiltrate first and threaten publication, which means backups alone no longer make you whole.
• Rootkit — hides the presence of other malware by subverting the system's own reporting, at user or kernel level. The defining feature is concealment: it makes files, processes and connections invisible to the tools you would normally use. A kernel-level rootkit cannot be trusted to be found by something running on the same kernel, which is why offline or boot-time scanning exists.

The distinctions the exam actually tests: virus needs a user, worm does not; trojan needs deception, worm needs a vulnerability; rootkit is about hiding, not about payload.

Spyware, bloatware, keylogger and logic bomb

• Spyware monitors activity and reports it — browsing, credentials, documents. Symptoms are subtle by design: new browser extensions, changed search or proxy settings, outbound connections to unfamiliar hosts.
• Bloatware is unwanted preinstalled software. It is not malicious, and CompTIA includes it because it enlarges the attack surface, often runs with privilege, and is frequently unpatched. Removing it is part of the secure baseline in Domain 4.
• Keylogger records keystrokes. It may be software or a physical device inline with the keyboard — which is worth remembering, because no software control finds a hardware one. Symptom-wise a software keylogger often shows up as a process with an unexpected hook or an unfamiliar scheduled task.
• Logic bomb is code that lies dormant until a trigger condition — a date, a file appearing, an employee's account being disabled. The last of those is the insider case, and the reason the trigger matters: a logic bomb is often placed by someone with legitimate access well before it fires, so investigation has to look further back than the incident date.

Command and control traffic, beaconing, and the indicator you can actually alert on

Most modern malware has to talk to its operator. That communication is the most reliable thing to detect, because it must happen repeatedly and it must leave the network.

Command and control (C2) is the channel. Beaconing is its signature: the implant checks in on a schedule, so you see many short, regular connections to the same destination, often with low data volume in one direction and instructions in the other.

What makes beaconing detectable is regularity, not content. The traffic is usually encrypted and often uses HTTPS or DNS precisely because those are allowed everywhere. So the indicators are:

• periodic connections at a consistent interval, including outside working hours, from a host that should be idle;
• connections to a destination with no other organisational history, or to a very recently registered domain;
• unusual DNS volume or unusually long query names, which is what DNS tunnelling looks like;
• a workstation making direct outbound connections that should be going through a proxy.

The practical controls: force outbound traffic through a proxy so direct connections are anomalies by definition, DNS filtering with logging, alerting on newly registered domains, and network flow analysis. Domain 4 covers each.

Fileless and living-off-the-land activity, and why signatures miss it

Fileless malware runs in memory without writing an executable to disk. Living off the land uses the tools already present and trusted — PowerShell, wmic, certutil, rundll32, scheduled tasks, WMI subscriptions — so there is no foreign binary at all.

Signature-based antivirus is structurally unable to catch this. It is looking for known files, and there is no file, or the file is a legitimate signed Microsoft binary.

What does catch it is behaviour: the process tree. A Word document that spawns PowerShell, which spawns cmd, which makes a network connection, is anomalous regardless of the fact that every binary involved is legitimate. That is exactly what EDR is for (Domain 4), and it is why the exam pairs "fileless" with "EDR" and "behavioural detection" rather than with "update the antivirus signatures".

Supporting controls: script block and command-line logging so the behaviour is recorded at all, constrained language mode or application control for scripting engines, and removing local administrator rights, which blocks a large share of the techniques outright.

Mapping an observed symptom back to a malware type under exam conditions

A quick table for the scenario questions:

Two habits that help. First, separate the delivery from the payload — "a phishing email delivered ransomware" involves a technique from 2.2 and a malware type from 2.4, and the question will ask about one of them. Second, notice whether the data was taken or only made unavailable, because that is the difference between an availability incident and a reportable data breach, and Domain 5 will ask you about the reporting duty.

What to take into the exam

• Virus needs a user; worm spreads itself; trojan relies on deception; rootkit hides other things.
• Ransomware is primarily an availability attack, and exfiltration-plus- encryption means backups alone no longer resolve it.
• Beaconing is detected by regularity, not content — and DNS is a favourite channel because it is always allowed.
• Fileless and living-off-the-land defeat signatures by design; the answers are EDR, behavioural detection, script logging and removing local admin.
• A hardware keylogger is invisible to every software control.