15.1 Identify and Analyze Malicious Code

ISC2 Systems Security Certified Practitioner SSCP

Track your progress as you read

Finished sections get a check mark.

1 Introduction and Exam Overview

1.1 Current Exam Facts 1.2 Computerized Adaptive Testing, Scoring, and Retakes 1.3 Eligibility, Associate Pathway, Endorsement, and Maintenance

2 Ethics and Security Concepts

2.1 Comply with Codes of Ethics 2.2 Understand Security Concepts 2.3 Identify and Implement Security Controls

3 Functional Controls, Assets, and Change Management

3.1 Document and Maintain Functional Security Controls 3.2 Support and Implement the Asset Management Lifecycle 3.3 Support and Implement the Change Management Lifecycle

4 Security Awareness and Physical Security Operations

4.1 Support and Implement Security Awareness and Training 4.2 Collaborate with Physical Security Operations

5 Authentication Methods and Trust Architectures

5.1 Implement and Maintain Authentication Methods 5.2 Federated Access with OAuth2, SAML, and OpenID Connect 5.3 Understand and Support Internetwork Trust Architectures

6 Identity Lifecycle and Access Control Models

6.1 Support and Implement the Identity Management Lifecycle 6.2 Mandatory, Discretionary, and Role-Based Access Control 6.3 Rule-Based, Attribute-Based, and Privileged Access Management

7 Risk Management, Visibility, and Legal Concerns

7.1 Risk Management Concepts and Treatment 7.2 Risk Visibility, Reporting, and Threat Intelligence 7.3 Legal and Regulatory Concerns

8 Assessments, Monitoring, and Analysis

8.1 Security Assessments and Vulnerability Management 8.2 Operate and Monitor Security Platforms 8.3 Analyze Monitoring Results

9 Incident Response and Forensic Investigations

9.1 Incident Response: Preparation, Detection, Analysis, and Escalation 9.2 Containment, Eradication, Recovery, and Lessons Learned 9.3 Understand and Support Forensic Investigations

10 Business Continuity and Disaster Recovery

10.1 Business Continuity and Emergency Response 10.2 Disaster Recovery and Restoration Metrics 10.3 Backup, Redundancy, Testing, and Drills

11 Cryptography Foundations

11.1 Reasons and Requirements for Cryptography 11.2 Hashing, Salting, Symmetric, Asymmetric, and ECC 11.3 Digital Signatures, HMAC, Algorithm Strength, and Cryptanalysis

12 Secure Protocols and Public Key Infrastructure

12.1 Understand and Implement Secure Protocols 12.2 Understand Public Key Infrastructure

13 Networking Fundamentals, Attacks, and Access Controls

13.1 Understand and Apply Fundamental Concepts of Networking 13.2 Understand Network Attacks and Countermeasures 13.3 Manage Network Access Controls

14 Network Security Operations, Wireless, and IoT

14.1 Manage Network Security 14.2 Operate and Configure Network-Based Security Appliances and Services 14.3 Secure Wireless Communications 14.4 Secure and Monitor Internet of Things

15 Malware, Malicious Activity, and Endpoint Security

15.1 Identify and Analyze Malicious Code 15.2 Malicious Activity, Social Engineering, and Behavior Analytics 15.3 Implement and Operate Endpoint Device Security

16 Mobile, Cloud, and Virtual Environments

16.1 Administer and Manage Mobile Devices 16.2 Cloud Security: Deployment, Service Models, and Shared Responsibility 16.3 Cloud Legal, Regulatory, and Third-Party Requirements 16.4 Operate and Maintain Secure Virtual Environments

15.1 Identify and Analyze Malicious Code

Key Takeaways Explain This Topic AI

SSCP knowledge area 7.1 (outline effective 1 October 2025) requires distinguishing malware types: a virus infects a host file, a worm self-propagates without a host, a trojan disguises itself and does not replicate, and fileless code lives in memory or legitimate interpreters.

Rootkits hide malware from local tools; trapdoors are undocumented developer entry points; backdoors are covert access paths, often planted after compromise.

Ransomware is extortion (often double extortion with theft); scareware frightens users into paying or installing more malware; spyware silently steals credentials and data.

Outline countermeasures are scanners, anti-malware, containment and remediation, and software security — match the control to the behavior, not to a brand name.

Encoded PowerShell spawned by Office with no new executable on disk is fileless tradecraft; a clean on-demand file scan does not close the incident.

Last updated: August 2026

Why malware analysis is a Domain 7 operations skill

Domain 7 of the ISC2 Systems Security Certified Practitioner ( SSCP ) exam — Systems and Application Security — is weighted at 15% under the outline effective 1 October 2025. Knowledge area 7.1 is Identify and analyze malicious code and activity . This section teaches the first two bullets: malware types (including application, code, operating system, and mobile-code vulnerabilities) and malware countermeasures. Malicious activity, social engineering, and behavior analytics are the next section. The host tools that instrument those countermeasures — host-based detection, allowlisting, encryption, endpoint detection and response (EDR) — are knowledge area 7.2.

The SSCP is a practitioner credential. You are not being asked to recite ransomware marketing names. You are being asked to look at a process tree, decide whether you are facing a virus , a worm , a trojan , fileless activity, or a rootkit , and then pick a countermeasure that matches: a scanner, isolation, remediation, or a software-security change so the same payload fails tomorrow.

Malware types the outline expects you to distinguish

The outline's examples are rootkits , spyware , scareware , ransomware , trojans , virus , worms , trapdoors , backdoors , fileless , and app/code/operating system (OS)/mobile code vulnerabilities . Those are not synonyms. Computerized Adaptive Testing ( CAT ) items will punish treating them as one pile labeled "malware."

Type What it does How it spreads or hides Operations tell

Virus Infects a host file, boot sector, or macro-enabled document Needs that host (and usually a user or process) to run so it can infect the next object Infected spreadsheet or a patched executable whose hash no longer matches the vendor

Worm Standalone, self-replicating code Moves across networks and shares without a host file Rapid Server Message Block ( SMB ) / Remote Desktop Protocol ( RDP ) / email fan-out from one unpatched hole

Trojan Malware disguised as legitimate software User or installer is tricked; it does not self-replicate "Free PDF converter" that also installs a remote-access tool

Ransomware Encrypts or locks data and demands payment Often delivered as a trojan, worm, or stolen remote desktop; double extortion adds theft plus a leak threat Mass file rename, ransom note, backup jobs dying

Spyware Secretly collects keystrokes, screens, credentials, browsing Bundled software, malicious extensions, or post-exploit tooling Unexpected outbound beacons, stolen session cookies

Scareware Frightens the user into paying or installing more malware Fake "Windows Security" alerts, tech-support pop-ups User calls a number from a banner and grants remote control

Rootkit Hides processes, files, and itself from the OS and tools User-mode, kernel-mode, bootkit or firmware Task Manager looks clean while another sensor still sees a command-and-control beacon

Backdoor Covert access that bypasses normal authentication Planted after compromise, or left as a vendor "support" account Unexpected listening port, hidden local admin, scheduled task that re-creates access

Trapdoor Undocumented entry point, classically built in by a developer Source-level or debug path that never got removed Maintenance account that ignores the identity provider

Fileless Little or no new executable on disk; lives in memory, registry, Windows Management Instrumentation (WMI) , or scripts Living-off-the-land binaries (LOLBins) such as PowerShell, rundll32, mshta, certutil Encoded PowerShell spawned by Office; disk scanners report clean

Trapdoor versus backdoor. Older literature uses trapdoor for an undocumented developer path (a debug login compiled into an application) and backdoor for covert access an attacker installs. The SSCP outline lists both. If the stem says a programmer left an undocumented maintenance account, that is a trapdoor. If the stem says the attacker added a hidden service after phishing, that is a backdoor. Both bypass normal authentication. Neither is "just a virus."

Virus, worm, and trojan — the triad that still shows up on CAT items

A virus needs a host. Macro viruses live in documents; file infectors prepend or append to executables; boot-sector viruses hit the boot record. Cleaning "the virus" without replacing or restoring the host object leaves the infection in place.

A worm does not need a host file. It is a self-contained program that copies itself to the next vulnerable service. WannaCry (2017) is the teaching example of a worm that carried a ransomware payload: the replication method was worm-like (SMBv1 EternalBlue); the business impact was ransomware. On the exam, name the behavior the stem describes, not the brand.

A trojan does not replicate itself. The user (or a software supply-chain installer) runs it because it looks useful. Remote-access trojans, fake codecs, and invoice attachments with a double extension are classic. If the stem emphasizes disguise and user execution with no self-propagation, answer trojan.

Ransomware, scareware, and spyware

Ransomware is extortion malware. Crypto-ransomware encrypts files; locker ransomware blocks the desktop. Modern operators steal data first ( double extortion ) so that restoring from backup does not end the incident. Paying is a legal, cyber-insurance, and executive decision — not an SSCP "remediation step." Operationally you still isolate, preserve evidence if required, and restore from a known-clean copy.

Scareware is social engineering wearing a malware costume: a full-screen alert claims the PC is infected and demands a credit card or a phone call. The payload may be fake antivirus that is spyware, or a remote-support session that becomes a backdoor. Treat the pop-up as untrusted.

Spyware is about confidentiality: keyloggers, infostealers, stalkerware, and aggressive helpers that harvest credentials or personally identifiable information (PII) . It may arrive as a trojan or as a "free" browser helper. Countermeasures overlap with data loss prevention (DLP) and secure browsing, but identification still starts with what is leaving the host.

Rootkits and why local scanners lie

A rootkit 's job is to make other malware (and itself) invisible to the local OS: hooking system calls, hiding directories, tampering with process lists. User-mode rootkits are easier to catch with a clean EDR agent. Kernel-mode implants and bootkits require offline imaging, a known-good kernel, or firmware inspection. If local antivirus says clean but network sensors still see a command-and-control (C2) beacon from that host, suspect a rootkit or fileless implant, not a healthy endpoint.

Fileless malware: the PowerShell scenario

Fileless malware minimizes on-disk artifacts. The outline lists it separately because signature scanners that only inspect files will miss it.

Scenario. You are the security administrator for a regional clinic. A receptionist opens a macro-enabled document from a patient-looking email. The on-demand file scan of the document is inconclusive. EDR shows the word processor spawning powershell.exe with a hidden window and a long encoded command. No new executable is written under Downloads. Script-block logging, if enabled, shows the interpreter downloading a reflective loader into memory and then performing credential access against the local security authority process.

That is fileless tradecraft using a living-off-the-land interpreter. Containment is isolate the host and kill the PowerShell tree — not "wait for the weekly on-demand scanner." Remediation includes revoking the user's tickets, checking for WMI or scheduled-task persistence (fileless does not mean no persistence), and a software-security fix: disable Office macros from the internet, enable Antimalware Scan Interface (AMSI) and Constrained Language Mode where the business allows, and allowlist which scripts can run.

Application, code, OS, and mobile-code vulnerabilities

Malware is often the payload . The hole is a vulnerability:

Surface Example hole What the attacker drops

Application Unpatched thick client, vulnerable library, insecure update channel Trojanized installer, macro, malicious plugin

• Code Injection (SQL, command), insecure deserialization, buffer overflow Webshell, in-memory loader
• Operating system Missing patches, SMBv1 left on, local privilege escalation Worm, ransomware, rootkit

Mobile code Browser scripts, legacy ActiveX, sideloaded mobile packages, configuration profiles Drive-by download, malicious profile that installs a backdoor

Mobile code in SSCP language is code that moves to the endpoint to execute — JavaScript in the browser, macros, mobile app packages — not only phones. Phone-specific administration ( mobile device management (MDM) , corporate-owned versus bring-your-own) is knowledge area 7.3. Here the point is: untrusted code running in a trusted process is still malware delivery.

Malware countermeasures

The outline's countermeasure examples are scanners , anti-malware , containment and remediation , and software security . Match the control to the malware's behavior.

Countermeasure What it is good for Failure mode

Scanners (on-demand or scheduled) Known file hashes, unpacking common packers, offline rescue scans when a rootkit may be hiding live tools Fileless memory implants; never-before-seen packing; scanners the rootkit can hide from

Anti-malware (real-time, cloud reputation, heuristics) Blocks known and suspicious executables at write or execute Users disable it "to install a driver"; it is not a substitute for isolation during an outbreak

Containment and remediation Isolate the host or virtual LAN, block C2, disable the account, remove persistence, restore known-clean state Cleaning one file while the worm is still on the production network; restoring an infected backup

Software security Patching, least privilege, application allowlisting, disabling macros and unsigned scripts, secure configuration Buying another scanner while Office still runs internet macros as the receptionist

Containment for malware is the same discipline as incident response knowledge area 4.1: stop spread first. Use EDR network isolation or disable the virtual network interface; disable the compromised identity; block the C2 domain or address at the firewall. Do not power off if memory must be captured for fileless or rootkit analysis.

Remediation is eradication plus a trustworthy rebuild: remove the binary, the scheduled task, the WMI subscription, the rogue local admin, and close the hole. If you cannot trust the volume (rootkit, firmware, ransomware), rebuild from a gold image rather than cleaning in place.

Software security is why the clinic still gets hit next month if you only delete the malicious document. Disable macros from the internet, apply the Office and OS patches, take local admin from the receptionist, and allowlist PowerShell to signed operations scripts. Scanners without software security are a treadmill.

Exam traps. Calling a self-propagating encryptor "only a virus." Treating a fake antivirus pop-up as a scanner finding. Assuming fileless means no persistence, so a reboot is remediation. Paying ransomware as the documented countermeasure. Using a local scanner as proof a rootkit is absent. When the stem gives you encoded PowerShell and a clean disk scan, name fileless malware and containment plus software security , not "close the ticket."