Cisco CyberOps Associate (CBROPS) 200-201Host-Based AnalysisHard
A security analyst is investigating a Windows workstation exhibiting signs of compromise, including unusual system crashes and blue screens of death (BSODs). The analyst suspects a kernel-mode rootkit has been installed. Which of the following host-based analysis techniques is most effective for detecting kernel-mode rootkits that hide processes, files, or network connections by directly manipulating kernel data structures?
- AReviewing standard Windows Event Logs.
- BPerforming an offline memory analysis of a full system memory dump.
- CMonitoring network traffic with Wireshark on the compromised host.
- DAnalyzing user-mode process lists with Task Manager.
Show answer & explanationAnswer & explanation
Correct answer: B. Performing an offline memory analysis of a full system memory dump.
Kernel-mode rootkits operate at the lowest level of the operating system, directly manipulating kernel data structures to hide their presence. They are undetectable by user-mode tools. Performing an offline analysis of a full system memory dump using specialized memory forensics tools (like Volatility) is the most effective way to detect these rootkits, as it allows for inspection of the raw kernel memory structures for inconsistencies.
Why the other options are wrong
- A. Standard Windows Event Logs typically record user-mode activities and system events, but kernel-mode rootkits can often bypass or manipulate these logs.
- C. Monitoring network traffic with Wireshark on the compromised host would show network activity, but a kernel-mode rootkit could hide its own connections from the capture tool or the OS.
- D. Task Manager operates in user-mode and cannot detect kernel-mode rootkits that hide processes.
Kernel-Mode Rootkit Detection
The process of identifying malicious software operating at the operating system's kernel level, which can hide its presence from user-mode tools.
- Undetectable by user-mode tools
- Manipulates kernel data structures
- Best detected via full memory dump analysis
Memory trick: Kernel ghosts hide deep; only memory's eye can see.