ExamFinch.com My Study

Study guide

Malware Behaviors and Indicators

Practice this exam

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Malware Behaviors and Indicators

Key Takeaways Explain This Topic AI

SY0-701 tests malware by behavior, impact, and indicators of compromise, then asks for the best containment or mitigation step.

Ransomware encrypts or exfiltrates data for extortion; worms self-propagate; Trojans hide malicious functions inside apparently useful software.

Fileless malware abuses trusted tools such as PowerShell and Windows Management Instrumentation, executing in memory to minimize disk artifacts.

Rootkits and bootkits prioritize stealth and persistence, while spyware and keyloggers prioritize collection of data and keystrokes.

Strong indicators include anomalous process trees, fixed-interval network beacons, persistence registry changes, mass file writes, and impossible-travel logins.

Last updated: June 2026

How the Exam Frames Malware

Malware (malicious software) is tested on SY0-701 by behavior far more than by vocabulary. The 90-question exam (90 minutes, passing score 750 on a 100-900 scale) rarely asks "define a worm." It describes what code does - encrypts files, steals credentials, hides itself, spreads without help, opens remote control, or abuses a trusted process - and asks you to name it or pick the best response. Read the scenario for behavior first, then map it to a type.

Malware type Primary behavior Common indicators First mitigation focus

Virus Attaches to files and needs execution Modified files, unexpected hash changes Remove infected files, restore clean copies

Worm Self-propagates across systems with no user action Rapid port scanning, repeated SMB (port 445) connections Segment network, block the propagation path, patch the flaw

Trojan Pretends to be legitimate software Unknown app, unexpected outbound sessions Remove the app, reimage if trust is lost

Ransomware Encrypts and often exfiltrates data first File renames, ransom note, mass write activity Isolate host, disable compromised account, preserve evidence

Spyware Secretly collects user or system data Browser hijack, unusual data uploads Remove software, review endpoint controls

Keylogger Captures keystrokes or form input Credential theft, suspicious input hooks Reset exposed credentials from a clean device

Rootkit Hides processes, files, or privileges Security-tool blind spots, kernel anomalies Rebuild from trusted media when integrity is uncertain

Backdoor / RAT Provides unauthorized remote access Beaconing, new listener, remote shell activity Block command-and-control, isolate, rotate credentials

Logic bomb Triggers on a date or event condition Timed or event-based destructive action Code review, change control, remove the trigger

Cryptominer Hijacks CPU/GPU for cryptocurrency Sustained high CPU/GPU, mining-pool connections Remove process, close initial access vector

Behavior Patterns and Fileless Malware

Fileless malware is a high-yield topic: it lives in memory and abuses trusted, signed binaries (a technique called living-off-the-land) so traditional signature antivirus sees little. PowerShell with an encoded -enc command line, wmic , mshta , and rundll32 are classic indicators. The behavior, not the file, is the giveaway.

  • Observed behavior What it suggests
  • Mass file encryption with extension renames Ransomware or destructive wiper
  • Credential access from LSASS memory or browser stores Infostealer or post-exploitation tool
  • New scheduled task or Run-key registry value Persistence mechanism
  • PowerShell downloading and decoding content Fileless / staged payload
  • DNS queries to a random-looking domain every 60 seconds Command-and-control beaconing
  • Lateral movement using admin shares (C , A D M I N , ADMIN , A D M I N ) Compromised privileged credentials
  • Worked Scenario

A workstation logs this sequence:

  • Time Evidence
  • 09:12 User opens invoice_viewer.exe from an email attachment
  • 09:13 powershell.exe starts with an encoded command line
  • 09:14 Dozens of documents are renamed with a new extension
  • 09:15 File-server logs show the same user modifying shared files

The chain points to a Trojan-delivered loader, fileless PowerShell staging, and ransomware impact spreading to a share. The best immediate action is containment : isolate the endpoint from the network, disable or reset the compromised account, and revoke access to affected shares. The incident-response order the exam rewards is preparation, identification, containment, eradication, recovery, lessons learned . Restoring from backup is recovery - it comes only after eradication, because restoring into a network where the root cause is still active simply reinfects the clean data.

Common Traps

Distractor Better exam reasoning

"Run antivirus only" while malware is actively spreading Contain first when active spread is confirmed; signature AV misses fileless

  • "Restore backups" before the infection path is closed Recovery can be reinfected if root cause remains
  • "Delete logs to save disk space" Preserve evidence and the timeline for forensics and legal hold
  • "A rootkit can be cleaned in place" Rebuild from trusted media if system integrity cannot be trusted
  • Persistence and Stealth Mechanisms

Beyond the initial infection, exam scenarios test how malware stays . Persistence keeps the malware running across reboots and logoffs, while stealth hides it from defenders. Recognizing these mechanisms in a description lets you classify the threat and choose eradication that actually removes it rather than just killing a single process.

  • Mechanism Where it lives Why it matters
  • Run / RunOnce registry keys Windows registry autostart Re-launches malware at every login
  • Scheduled task or cron job OS task scheduler Survives reboot; can trigger on a timer
  • Service installation New Windows service or daemon Runs with high privilege at boot
  • Bootkit / UEFI implant Boot firmware or MBR Loads before the OS and antivirus
  • DLL search-order hijack Application load path Injects code into a trusted process
  • Rootkit hooking Kernel or user-mode APIs Hides files, processes, and connections

A potentially unwanted program (PUP) is a softer category - adware or bundled toolbars that are not overtly malicious but degrade the system and may track users. The exam contrasts PUPs with true malware to test whether you over-escalate a low-severity finding.

Quick Drill

Name the likely behavior for each clue: (1) hundreds of connection attempts to TCP 445 across subnets - worm propagation or lateral movement; (2) credentials used from a new country minutes after a normal session - infostealer or keylogger; (3) small encrypted packets to one external host every 60 seconds - C2 beaconing; (4) a process invisible to security tools but proven active in network logs - rootkit or tampering; (5) a new service that re-spawns the payload after every reboot - persistence via service installation.