Exam CS0-002 topic 1 question 200 discussion

"a well know malware" means "an up to date antivirus" should already has the signature. So answer C is completely wrong.

C. The antivirus does not have the malware's signature. Antivirus relies on signature-based detection, and new or obfuscated malware might evade detection until the antivirus is updated with the latest signatures.

C. The antivirus does not have the malware's signature. If the antivirus cannot detect the malicious executable, it may be because the antivirus does not have the specific signature or pattern of the malware in its database. Antivirus programs rely on signatures, heuristics, and other detection methods to identify and block known malware. If the malware is new or has been modified in a way that changes its signature, the antivirus may not be able to recognize it.

Even though it is "Well-known" and the anti-virus is "up-to-date" it does not mean that they have the signatures in the AV. The only reason I don't think it's fileless is because the security analyst detected a well-known EXECUTABLE (Which is a file). So how the hell could it be fileless? Not a good question.

I will be the only one to go with C then C. The antivirus does not have the malware's signature. Antivirus software typically relies on a database of known malware signatures to detect and prevent malicious executables from running on a system. If the antivirus does not have the specific signature of the well-known malicious executable in its database, it will not be able to identify and block it.

CompTIA guide says: Most modern malware uses similar fileless techniques to avoid detection by signaturebased A-V and file integrity monitoring security software. Fileless means that the malware code is executed by a script or small piece of shellcode to create a process in system memory without having to use the local file system; some fileless techniques do depend on dropping the initial script to a temporary directory, though.

The SIEM detects a "malicious executable" AKA a FILE right? Why would a fileless virus be using a malicious file? I think C - just because the antivirus is up-to-date doesn't mean it has the same signatures as every other antivirus. Check your results on HybridAnalysis or VirusTotal, and you will see - not every AV detects threats as threats. Maybe they have a crappy antivirus

“Well known” “up to date”

Antivirus software typically relies on malware signatures or patterns to detect and block malware. Malware signatures are unique characteristics or patterns of code that are associated with specific malware variants. If the malware does not have a signature that is recognized by the antivirus, it will not be detected or blocked, even if the antivirus is up-to-date.

For God's sake people "detects a well-known malicious executable. The up-to-date antivirus" How on earth can you go with C based off of that....

Fileless malware can be difficult to detect by traditional antivirus (AV) software, as it does not rely on creating or modifying files on a system's hard drive. Instead, fileless malware operates entirely in memory, using legitimate system processes and tools, such as PowerShell or Windows Management Instrumentation (WMI), to carry out its malicious activities. Some AV software may be able to detect fileless malware by monitoring system memory and identifying suspicious behavior, but it is generally considered more difficult to detect than malware that uses files.

A. The malware fileless and exists only in physical memory. A fileless malware is a type of malware that lives in the memory of a computer, rather than on its hard drive. Because the malware doesn't create files or leave traces of itself on the hard drive, it can be difficult to detect with traditional antivirus software. It may evade detection by running only in memory, and it may also manipulate or hide itself from the operating system, making it difficult to detect. The malware detects and prevents its own execution in a virtual environment (B) is a technique used by some advanced persistent threat (APT) groups, but it is not the most likely cause of this issue. The antivirus does not have the malware's signature (C) is a possible cause but it's not the most likely cause since the malware is known by the analyst. The malware is being executed with administrative privileges (D) is a possible cause but it's not the most likely cause since the malware is fileless and exist only in physical memory.

AV, signatures need to be updated.

The AV vendor most likely doesn't contain the malicious signature. This is the case in VirusTotal as well, you can search a known malicious hash and you'd be surprised how many AV vendors it bypasses.

AV cannot detect malware because it has not proper signatures, its obvious?