I am trying to going into a new military occupational speciality for the cyber community and I am having some difficulty with some of the questions on a questionnaire. The two questions I am having trouble are as followed. I am willing to read other websites to find the answers.
How can a Windows process list, viewed either through Tasklist or Pslist, be used to identify malicious processes? Identify at least 3 ways.
A piece of malware is running on a Windows 7 machine via process injection, so it does not show up in a process list. What remote forensic technique could be used to discover the malware is running under the contents of a specific process?