Threats, Vulnerabilities, and Mitigations →easyMultiple ChoiceObjective-mapped

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Exhibit

EDR Alert - WS-14
Time: 03:14:22
Parent process: svchost.exe
Child process: powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand <redacted>
Network activity: HTTPS request to hxxps://updates-check[.]com/a7
File creation: none detected
Registry change: Run key modified under HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?

⚠ Common exam trap

It's easy for candidates to confuse fileless malware with a Trojan because both can use PowerShell, but the key distinction is that fileless malware avoids writing to disk, while a Trojan relies on a dropped executable file.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Fileless malware

The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Trojan
Why it's wrong here
A trojan is typically a standalone executable that relies on social engineering to trick a user into running it, often disguised as legitimate software. The exhibit, however, shows PowerShell launching encoded commands directly into memory with no evidence of a user-executed binary or dropper. While a trojan might create registry persistence, it primarily delivers a visible file payload, which is absent here, making fileless malware the better classification.
✓
Fileless malware
Why this is correct
The alert shows PowerShell launching with encoded commands, hidden execution, and no suspicious file written to disk. That behavior strongly suggests fileless malware, which relies on built-in tools and memory rather than dropping a traditional executable. The registry change also indicates persistence without a visible file-based payload.
✗
Worm
Why it's wrong here
A worm is self-propagating malware that exploits network vulnerabilities or spreads automatically by sending copies of itself to other systems without user interaction. The alert describes a single host running PowerShell with hidden execution and a registry change, but there is no indication of scanning, lateral movement, or outbound replication traffic. Since fileless attacks can also spread via infection vectors like email attachments, the lack of network-based spreading distinguishes this behavior from a worm.
✗
Rootkit
Why it's wrong here
A rootkit is designed to gain privileged, kernel-level access and hide the presence of malware by hooking system calls, patching boot processes, or modifying low-level OS structures. The exhibit instead highlights user-space PowerShell activities, encoded commands, and a simple registry run key, none of which conceal kernel-level processes or drivers. Rootkits typically emphasize stealth and persistence over active scripted execution, so the observed activity aligns more closely with fileless malware than with rootkit compromise.

Go deeper

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question