For detecting memory-resident malware, it's essential to analyze:

The correct answer is B. Memory allocation patterns. Memory-resident malware (also called fileless malware) lives entirely in RAM, never writing to disk, which makes memory allocation patterns (B) the only viable detection surface - analysts examine process memory, heap allocations, injected code regions, and anomalous executable…

Threat Hunting Techniques

Question

Options

ADisk storage allocation
BMemory allocation patterns
CCloud storage access logs
DUSB device history

How the community answered

(43 responses)

A
7% (3)
B
79% (34)
C
2% (1)
D
12% (5)

Explanation

Memory-resident malware (also called fileless malware) lives entirely in RAM, never writing to disk, which makes memory allocation patterns (B) the only viable detection surface - analysts examine process memory, heap allocations, injected code regions, and anomalous executable segments using tools like Volatility. Disk storage allocation (A) is irrelevant because fileless malware deliberately avoids touching the filesystem, which is precisely what makes it dangerous. Cloud storage access logs (C) and USB device history (D) are peripheral forensic sources useful for tracking data exfiltration or initial infection vectors, but they reveal nothing about what's currently executing in RAM.

Memory tip: Think "resident = RAM" - if malware is memory-resident, your analysis must be memory-focused. The word "resident" maps directly to where it lives.

Topics

#Memory-resident malware#Memory forensics#Malware detection#Memory allocation analysis

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice