Exam 312-50v11 topic 1 question 164 discussion

IDS/IPS has not reported on any non-whitelisted programs. File-less malware

It can't be "zero-day" malware because the company is whitelisting applications. That means that NOTHING can run unless it has been expressly allowed. It doesn't matter if the exploit / malware is known or not. It can't run because it is not whitelisted. File-less malware is attached to another file. In this case, one that is whitelisted.

Fileless Malware Fileless malware can easily evade various security controls, organizations need to focus on monitoring, detecting, and preventing malicious activities instead of using traditional approaches such as scanning for malware through file signatures.Also known as non-malware, infects legitimate software, applications, and other protocols existing in the system to perform various malicious activities.It resides in the system’s RAM. It injects malicious code into the running processes. (P.966/950)

At first I would have sworn Zero-day but reading it again and again the keyword is "bypass the company's application whitelisting" that would point at fileless.

A. File-less malware

terminology there is no "zero-day malware", it's just "malware" which of course could be introduced by as a component of a zero-day exploit campaign by an expert somebody whom correctly identifies a zero-day vulnerability in the system to be attacked

No sense it can be a zery-day malware too......

File less malware and zero day both are correct.. depends on which answer ec council likes more..

Why not zero-day? Antivirus or IDS cannot detect if it's a new one and they don't have signatures...

IDS monitors traffic on the network, so you should be able to find any unusual communications, but why can't you find fileless malware?

correct

https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-fileless-malware.html