I am trying to going into a new military occupational speciality for the cyber community and I am having some difficulty with some of the questions on a questionnaire. The two questions I am having trouble are as followed. I am willing to read other websites to find the answers.

  1. How can a Windows process list, viewed either through Tasklist or Pslist, be used to identify malicious processes? Identify at least 3 ways.

  2. A piece of malware is running on a Windows 7 machine via process injection, so it does not show up in a process list. What remote forensic technique could be used to discover the malware is running under the contents of a specific process?

  • 3
    Ok, then is it appropriate for us to help? Isn't this supposed to be up to the candidate to answer the questions? – schroeder Jun 11 '17 at 15:12
  1. You can spot processes that:

    • have a similar name with an officially named process - example: svch0st instead of svchost, expiorer explorer

    • have randomly generated names - examples : fh74w7ha, xf8f4a34, m599j42k.

    • have insufficient/inaccurate general description - example: file

  2. You can detect P.I. malware by studying:

    • Parent-Child process relationship (example: processes named accordingly but not started by winlogon.exe or wininit.exe but by another process)

    • Usage of suspicious memory protection (PAGE_EXECUTE_READWRITE - sometimes at a round address like 0x1000000).

    • Comparison between PEB and the VAD structure (process memory vs kernel memory)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.