Identifying memory-resident attacks often requires the use of:

The correct answer is B. Memory analysis tools. Memory-resident attacks (also called fileless malware) execute entirely in RAM, leaving little to no traces on disk, so memory analysis tools are required to capture and inspect volatile data like running processes, injected code, and suspicious artifacts before they disappear…

Threat Hunting Techniques

Question

Options

ADisk-based forensics tools
BMemory analysis tools
CNetwork sniffers
DAntivirus software

How the community answered

(29 responses)

A
3% (1)
B
90% (26)
C
7% (2)

Explanation

Memory-resident attacks (also called fileless malware) execute entirely in RAM, leaving little to no traces on disk, so memory analysis tools are required to capture and inspect volatile data like running processes, injected code, and suspicious artifacts before they disappear on reboot.

Why the distractors are wrong:

A (Disk-based forensics): These attacks intentionally avoid writing to disk, so disk imaging and file carving yield nothing useful.
C (Network sniffers): While some malware communicates over the network, sniffers capture traffic-not the in-memory code executing on the host.
D (Antivirus software): Traditional AV scans files on disk using signature matching; it typically cannot inspect or detect code living only in RAM.

Memory tip: Think "fileless = no files = no disk evidence." If the attack leaves no files, you need a tool that reads what is there - memory. Tools like Volatility or WinPmem are the go-to for this.

Topics

#Memory forensics#Malware analysis#Memory-resident malware#Forensic tools

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice