CompTIA A+ Core 2 (220-1202)Software TroubleshootingHard
A technician runs a full antivirus scan on a workstation and finds no infected files, yet the system exhibits suspicious behavior such as unexpected outbound network connections. The technician suspects fileless malware abusing legitimate tools like PowerShell for persistence and execution. Which tool would be MOST useful for identifying this malicious activity?
- ADevice Manager
- BTask Scheduler
- CDisk Cleanup
- DWindows Event Viewer
Show answer & explanationAnswer & explanation
Correct answer: D. Windows Event Viewer
Fileless malware operates in memory using legitimate processes like PowerShell, leaving no traditional files for antivirus to scan. Windows Event Viewer, particularly the PowerShell Operational and Security logs, can reveal suspicious script block execution, unusual command-line arguments, and other indicators of fileless attacks.
Why the other options are wrong
- A. Device Manager manages hardware, not process or script execution logs.
- B. Task Scheduler shows scheduled tasks but not the detailed execution/behavior logs needed to trace fileless activity.
- C. Disk Cleanup removes temporary files and has no security investigation capability.
Fileless Malware Detection
Fileless malware resides in memory or abuses legitimate tools (e.g., PowerShell, WMI) rather than writing files to disk, evading traditional antivirus signature scans.
- Traditional file-based AV scans often miss fileless malware
- Windows Event Viewer PowerShell/Security logs can reveal suspicious execution
- Detection often requires behavioral/log analysis rather than file scanning
Memory trick: No files to scan? Check the logs — 'Ghosts leave footprints in Event Viewer'