A security analyst is investigating a suspected malware infection on a Windows workstation. The EDR solution reports a process named `svch0st.exe` (note the '0' instead of 'o') running from `C:\Users\Public\Documents\` and making outbound connections to a known malicious IP address. The legitimate `svchost.exe` is typically located in `C:\Windows\System32\`. Which common defense evasion technique is this malware most likely employing?
- ADLL Side-Loading
- BProcess Hollowing
- CMasquerading
- DReflective Code Loading
Show answer & explanationAnswer & explanation
Correct answer: C. Masquerading
The malware is using a misspelled name (`svch0st.exe` instead of `svchost.exe`) and running from a non-standard directory (`C:\Users\Public\Documents\` instead of `C:\Windows\System32\`). This combination is a classic example of masquerading, where an attacker attempts to hide malicious code by naming it similarly to a legitimate process or placing it in an unexpected location to blend in and evade detection.
Why the other options are wrong
- A. DLL side-loading involves placing a malicious DLL in a location where a legitimate application expects to load a benign DLL, which is not what's described here.
- B. Process hollowing involves injecting malicious code into the memory space of a legitimate, suspended process, not creating a new, similarly named executable.
- D. Reflective code loading involves loading a malicious DLL directly into memory without it being present on disk, which is not indicated by a distinct executable file `svch0st.exe`.
Masquerading (Defense Evasion)
Masquerading is a defense evasion technique where an adversary attempts to hide their malicious activity by making it appear as legitimate system or user activity. This often involves using legitimate process names, misspellings, or placing malicious files in unexpected but seemingly benign locations.
- Uses legitimate process names or close misspellings.
- Often places files in non-standard but plausible directories.
- Aims to blend in with normal system operations to avoid suspicion.
Memory trick: Evasion is like hiding in plain sight from the guards.