I am trying to going into a new military occupational speciality for the cyber community and I am having some difficulty with some of the questions on a questionnaire. The two questions I am having trouble are as followed. I am willing to read other websites to find the answers.

  1. How can a Windows process list, viewed either through Tasklist or Pslist, be used to identify malicious processes? Identify at least 3 ways.

  2. A piece of malware is running on a Windows 7 machine via process injection, so it does not show up in a process list. What remote forensic technique could be used to discover the malware is running under the contents of a specific process?

  • 3
    Ok, then is it appropriate for us to help? Isn't this supposed to be up to the candidate to answer the questions?
    – schroeder
    Commented Jun 11, 2017 at 15:12

1 Answer 1

  1. You can spot processes that:

    • have a similar name with an officially named process - example: svch0st instead of svchost, expiorer explorer

    • have randomly generated names - examples : fh74w7ha, xf8f4a34, m599j42k.

    • have insufficient/inaccurate general description - example: file

  2. You can detect P.I. malware by studying:

    • Parent-Child process relationship (example: processes named accordingly but not started by winlogon.exe or wininit.exe but by another process)

    • Usage of suspicious memory protection (PAGE_EXECUTE_READWRITE - sometimes at a round address like 0x1000000).

    • Comparison between PEB and the VAD structure (process memory vs kernel memory)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .