nerdexam
EC-Council

312-50V9 · Question #82

How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?

The correct answer is D. Attaching itself to the master boot record in a hard drive and changing the machine's boot. A bootkit rootkit bypasses Windows kernel-mode code signing by injecting itself into the Master Boot Record, executing before the OS loader and its signing enforcement are initialized.

Malware Threats

Question

How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?

Options

  • ADefeating the scanner from detecting any code change at the kernel
  • BReplacing patch system calls with its own version that hides the rootkit (attacker's) actions
  • CPerforming common services for the application process and replacing real applications with fake
  • DAttaching itself to the master boot record in a hard drive and changing the machine's boot

How the community answered

(26 responses)
  • A
    12% (3)
  • B
    4% (1)
  • C
    4% (1)
  • D
    81% (21)

Why each option

A bootkit rootkit bypasses Windows kernel-mode code signing by injecting itself into the Master Boot Record, executing before the OS loader and its signing enforcement are initialized.

ADefeating the scanner from detecting any code change at the kernel

Defeating a scanner from detecting code changes describes anti-forensic or anti-AV evasion, which is a separate technique unrelated to bypassing kernel-mode code signing policy.

BReplacing patch system calls with its own version that hides the rootkit (attacker's) actions

Replacing system call entries (SSDT hooking) is a kernel-level hooking technique used to hide rootkit activity after the OS has loaded, not a method for bypassing the code signing policy during boot.

CPerforming common services for the application process and replacing real applications with fake

Replacing real applications with fake ones describes Trojanizing user-mode executables, which operates at user space and does not interact with the kernel-mode code signing enforcement mechanism.

DAttaching itself to the master boot record in a hard drive and changing the machine's bootCorrect

By attaching to the Master Boot Record (MBR), the rootkit executes during the early boot phase before the Windows kernel and its code signing policy (PatchGuard/DSE) are loaded. This pre-OS execution lets the rootkit manipulate the boot process and load unsigned or malicious kernel components that would otherwise be blocked by Windows 7's kernel-mode code signing enforcement.

Concept tested: MBR bootkit bypass of kernel-mode code signing policy

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#secure-boot

Topics

#rootkit#kernel mode#code signing bypass#boot sector

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice