Malware

Question 1

How can Malware establish persistence to survive a reboot (WIN) ?

Answer 1

1. AutoStart
2. Service Creation / Replacement
3. Service Failure Recovery
4. Scheduled Tasks
5. DLL Hijacking
6. WMI Event Consumer
7. Local Group Policy
8. Ms Office Add-On
9. BIOS flashing

Question 2

What are some common Malware defense evasion techniques ?

Answer 2

1. Service Hijacking
2. Service Replacement
3. Process Injection
4. Filename / Service hijacking
5. Alternate Data Streams
6. Webshells / Beacons
7. firmware updates
8. DLL Injection
9. A/V Bypass
10. Rootkits (hooking)
11. Binary Padding
12. Packing / Armouring
13. Trusted Code Sigining (malware is signed)

Question 3

What are some common malware locations ?

Answer 3

1. \Temp
2. \Windows
3. \Win\SxS
4. \System Volume
5. \Recycle Bin
6. \Program Files
7. temporary internet files