Malware and Compromise Indicators Recognition Questions

Understanding common indicators of malware infection: unexpected network connections, unusual processes running, file system changes, system performance degradation. Recognizing signs of account compromise: failed login attempts followed by success, access to unusual resources, activity during off-hours. Understanding persistence mechanisms that attackers use. Recognizing lateral movement within a network: unusual connections between systems, unexpected data access. Knowing when a system should be isolated immediately.

HardSystem Design

64 practiced

Design an automated containment workflow that links SIEM detections with EDR actions to isolate a host when multiple high-confidence indicators (for instance a ransomware kill chain pattern) are observed. Describe the decision logic, confidence scoring, safeguards to prevent accidental isolation, escalation paths and a rollback procedure to un-isolate a host.

Sample Answer

**Clarify requirements & assumptions**- Goal: automated isolation via EDR when SIEM detects multi-signal high-confidence attack (e.g., ransomware chain).- Constraints: avoid business disruption, preserve forensic data, comply with change/infra policies.

**High-level flow**- SIEM aggregates detections → correlation engine builds incident → compute confidence score → automation trigger evaluates safeguards → EDR isolates host (or escalates) → post-action validation and rollback.

**Decision logic & confidence scoring**- Score = weighted sum of indicators: privilege escalation (30%), suspicious process/spawn (25%), mass file modification (25%), C2 beaconing (15%), known IOCs (5%); weights adjustable.- Thresholds: >85% auto-isolate; 60–85% require analyst approval; <60% only alert.- Increase score for temporal clustering, same username, or multiple sensors agreeing.

**Safeguards to prevent accidental isolation**- Business-critical host whitelist + service-impact tags (AD controllers, database servers).- Verify EDR connectivity and health; require at least two independent signals (SIEM + EDR telemetry).- Rate-limit isolates per window; require maintenance-window bypass for scheduled windows.

**Escalation paths**- 60–85%: create ticket, notify on-call via SMS/Slack with one-click approve; automatic 15-min timeout to escalate to SOC lead.- >85% and non-critical host: auto-isolate and notify.- Critical hosts always route to on-call with recommended action.

**Rollback & remediation**- Pre-isolation snapshot of forensic artifacts (memory, disk, network captures) and EDR context.- Isolation includes metadata tag and playbook runbook creation.- Un-isolate flow: analyst runs automated health checks and malware scan; if clean, revoke isolation via EDR and document justification. If false positive, adjust correlation rules and CI/CD push to playbook.

**Metrics & continuous improvement**- Track false-positive rate, mean time to isolate, business impact incidents; tune weights and add ML anomaly detection.

EasyTechnical

106 practiced

Name and briefly describe common persistence mechanisms attackers use on Windows endpoints. For each mechanism provide at least one detection technique or log source that would reveal that persistence (for example scheduled tasks, services, registry run keys, WMI, DLL search order hijacking). Explain a quick remediation action for each mechanism.

Sample Answer

**Overview**As an Information Security Analyst I'd monitor common Windows persistence mechanisms, detect them via logs/EDR, and take quick remediation to remove footholds.

**Scheduled Tasks**- Description: Tasks that run programs on schedule or at user logon.- Detection: Windows Task Scheduler logs (Microsoft-Windows-TaskScheduler/Operational), Sysmon Event ID 1/7 for task file creation, EDR process creation alerts.- Remediation: Disable and delete the task, collect task XML for IOC analysis, block associated binary/hash with EDR.

**Windows Services**- Description: Persistent background processes (service binary or dllhost).- Detection: Service creation/modification via Sysmon Event ID 7045, Windows System event logs, EDR service change alerts.- Remediation: Stop and set service to disabled, remove service binary, investigate account permissions and revert changes.

**Registry Run Keys**- Description: Autorun keys (HKLM/HKCU Run, RunOnce, Winlogon Shell/Userinit).- Detection: Registry auditing, Sysmon Event ID 13 (registry), SIEM alerts on new values under Run keys.- Remediation: Delete malicious values, quarantine binary, restore registry backup, restrict write permissions via GPO.

**WMI (Event Subscriptions)**- Description: Permanent event consumers/subscriptions trigger payloads without obvious artifacts.- Detection: Query WMI subscriptions (Get-WmiObject -Namespace root\subscription -Class __EventFilter/__EventConsumer/__FilterToConsumerBinding), Windows Management Instrumentation logs.- Remediation: Remove malicious subscription (wbemutil /remove), restart WMI service if needed, block consumer binary.

**DLL Search Order Hijacking**- Description: Placing malicious DLLs where legitimate apps will load them.- Detection: EDR rare DLL loaded by process, Sysmon Event ID 7/8 for image loads, Filemonitor alerts where DLL name conflicts with legitimate locations.- Remediation: Remove rogue DLLs, replace with legitimate files, update software to use full paths or SafeDllSearchMode, block offending hashes.

**Startup Folder / Shortcuts**- Description: Malicious shortcuts or executables placed in user/startup dirs.- Detection: File system changes in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, Sysmon file create events.- Remediation: Delete shortcut/executable, validate origin, apply user folder write restrictions.

For each mechanism I prioritize collecting forensic artifacts, blocking IOCs in EDR, and applying least-privilege/GPO hardening to prevent reoccurrence.

HardSystem Design

56 practiced

Design a scalable detection architecture for lateral movement and malware detection for an enterprise of 50,000 endpoints. Describe the telemetry pipeline, storage choices, indexing/retention trade-offs, where detection analytics run (central vs edge), and how you would maintain acceptable alert latency while controlling cost.

Sample Answer

**Clarify requirements & assumptions**- 50k endpoints, mixed OS, 24/7 coverage, target alert latency ≤ 2 minutes for high-confidence lateral/malware alerts, budget-conscious.

**High-level architecture**- Endpoint agents -> Message bus/ingest -> Stream processing (real-time) -> Detection orchestration -> Long-term store / SIEM / Hunting UI

**Telemetry pipeline**- Agents collect events: process/create/exec, DNS, NetFlow, SMB/LSARPC, EDR telemetry, Windows Event IDs, authentication logs.- Agents forward to edge collectors via Kafka or managed pub/sub (TLS, mTLS, compression, batching).- Stream layer: Kafka topics -> real-time consumers (Flink/ksql/Streams) for enrichment (asset DB, identity) and fast detections.- Alert bus publishes to SOAR, SIEM, and analyst dashboards.

**Storage & indexing / retention trade-offs**- Hot store: time-series DB / Elasticsearch for 7–14 days of indexed full-fidelity events for fast queries and correlation.- Warm store: columnar object store (Parquet on S3 or equivalent) for 30–90 days, partitioned by date, hostname, event type — cheaper, slower for ad-hoc hunts.- Cold store: compressed archival (Glacier) for 1–3 years for compliance.- Indexing: index minimally (fields used in queries: src/dst IP, user, process hash, file path). Full-text indexing only for alerts/logs.- Trade-off: index depth vs cost — keep high-cardinality fields out of index; use bloom filters/secondary indices for selective hunts.

**Where detections run**- Edge (agent/local): immediate IOC matches, behavioral heuristics, credential dumping prevention — reduces noise/latency and bandwidth.- Central stream: complex graph-based lateral movement detection, statistical baselining, ML enrichment, cross-endpoint correlation. Centralized allows richer context and reduces false positives.

**Maintaining latency while controlling cost**- Prioritize detections: tier 0 (block/alert in <2 min) at edge + stream; tier 1 (complex hunts) async with longer SLAs.- Use sampling for noisy telemetry (but keep auth/process logs unsampled).- Use incremental enrichment and feature stores to avoid recomputation.- Autoscale stream consumers and query nodes; use query caches and precomputed join tables for common detections.- Alert deduplication, scoring, and suppression to reduce analyst load and cost.

**Operational considerations**- Continuous tuning, red/blue team validation, runbooks, SLA metrics (MTTA/MTTR), telemetry-health dashboards, and cost per GB monitoring.

MediumTechnical

73 practiced

Describe detection techniques for credential dumping tools like Mimikatz on Windows. Include which event types, EDR signals or Sysmon behaviors you would monitor (for example lsass memory reads, suspicious process handles, unusual service creations) and practical mitigations to reduce the attack surface.

Sample Answer

**Situation / Goal**I monitor Windows estates for credential dumping (Mimikatz-like) and must detect typical behaviors and harden hosts.

**Detection signals to monitor**- Windows Event Logs: Security Event 4624/4625 (suspicious logon patterns), 4648 (explicit credential use), 4672 (privileged), 4688 (process creation) with parent/child anomalies.- Sysmon: ID 10 (process access) to flag lsass.exe reads, ID 11 (file create), ID 3 (network connection) for lateral movement, ID 7 (registry), ID 8 (create remote thread), ID 6 (driver load). Correlate process creation (4688/Sysmon 1) where PROCESS_NAME reads lsass or creates dump utilities.- EDR signals: Unusual access to lsass memory, handle open to lsass with PROCESS_VM_READ/WRITE/OPEN_PROCESS, in-memory-only payloads, reflective DLL loads, suspicious tokens, and commands invoking sekurlsa::logonpasswords, procdump, comsvcs.dll usage.- Behavioral heuristics: Parent-child mismatches (e.g., explorer -> cmd -> procdump), ephemeral scheduled tasks/services, renamed known tools, abnormal CLI arguments like -ma, -accepteula.

**Practical mitigations**- Enable LSASS protection: LSA Protection (RunAsPPL), Credential Guard (where supported), and restrict debugging privileges.- Apply least privilege: remove local admin where possible; use LAPS for admin password management.- Harden logging and collection: enable Sysmon with rules to capture process access and image loads; forward to SIEM; create detections for Sysmon 10 + 1 combinations.- Block/deny known dumping tools via AppLocker/WDAC and EDR execution prevention; enforce code integrity.- Network/EDR controls: block outbound from endpoints except required ports, enforce MFA to reduce downstream utility of stolen creds.- Incident playbook: isolate host, collect volatile memory with approved tooling, analyze EDR telemetry for parent/child and handle-open chains.

I prioritize detections that combine lsass memory access (Sysmon 10), suspicious process creation (Sysmon 1/4688), and EDR handle/open_process signals to reduce false positives while catching Mimikatz-like activity.

HardTechnical

77 practiced

Describe the legal, privacy and evidentiary considerations you must weigh when isolating a host suspected of malware in a jurisdiction with strict data protection laws (for example GDPR). How do you balance immediate containment, forensic evidence preservation and privacy obligations, and what process steps would you put in place to comply with legal requirements while responding quickly?

Unlock Full Question Bank

Get access to hundreds of Malware and Compromise Indicators Recognition interview questions and detailed answers.

Join thousands of developers preparing for their dream job.