15.1 Identify and Analyze Malicious Code
Key Takeaways
- SSCP knowledge area 7.1 (outline effective 1 October 2025) requires distinguishing malware types: a virus infects a host file, a worm self-propagates without a host, a trojan disguises itself and does not replicate, and fileless code lives in memory or legitimate interpreters.
- Rootkits hide malware from local tools; trapdoors are undocumented developer entry points; backdoors are covert access paths, often planted after compromise.
- Ransomware is extortion (often double extortion with theft); scareware frightens users into paying or installing more malware; spyware silently steals credentials and data.
- Outline countermeasures are scanners, anti-malware, containment and remediation, and software security — match the control to the behavior, not to a brand name.
- Encoded PowerShell spawned by Office with no new executable on disk is fileless tradecraft; a clean on-demand file scan does not close the incident.
Why malware analysis is a Domain 7 operations skill
Domain 7 of the ISC2 Systems Security Certified Practitioner (SSCP) exam — Systems and Application Security — is weighted at 15% under the outline effective 1 October 2025. Knowledge area 7.1 is Identify and analyze malicious code and activity. This section teaches the first two bullets: malware types (including application, code, operating system, and mobile-code vulnerabilities) and malware countermeasures. Malicious activity, social engineering, and behavior analytics are the next section. The host tools that instrument those countermeasures — host-based detection, allowlisting, encryption, endpoint detection and response (EDR) — are knowledge area 7.2.
The SSCP is a practitioner credential. You are not being asked to recite ransomware marketing names. You are being asked to look at a process tree, decide whether you are facing a virus, a worm, a trojan, fileless activity, or a rootkit, and then pick a countermeasure that matches: a scanner, isolation, remediation, or a software-security change so the same payload fails tomorrow.
Malware types the outline expects you to distinguish
The outline's examples are rootkits, spyware, scareware, ransomware, trojans, virus, worms, trapdoors, backdoors, fileless, and app/code/operating system (OS)/mobile code vulnerabilities. Those are not synonyms. Computerized Adaptive Testing (CAT) items will punish treating them as one pile labeled "malware."
| Type | What it does | How it spreads or hides | Operations tell |
|---|---|---|---|
| Virus | Infects a host file, boot sector, or macro-enabled document | Needs that host (and usually a user or process) to run so it can infect the next object | Infected spreadsheet or a patched executable whose hash no longer matches the vendor |
| Worm | Standalone, self-replicating code | Moves across networks and shares without a host file | Rapid Server Message Block (SMB) / Remote Desktop Protocol (RDP) / email fan-out from one unpatched hole |
| Trojan | Malware disguised as legitimate software | User or installer is tricked; it does not self-replicate | "Free PDF converter" that also installs a remote-access tool |
| Ransomware | Encrypts or locks data and demands payment | Often delivered as a trojan, worm, or stolen remote desktop; double extortion adds theft plus a leak threat | Mass file rename, ransom note, backup jobs dying |
| Spyware | Secretly collects keystrokes, screens, credentials, browsing | Bundled software, malicious extensions, or post-exploit tooling | Unexpected outbound beacons, stolen session cookies |
| Scareware | Frightens the user into paying or installing more malware | Fake "Windows Security" alerts, tech-support pop-ups | User calls a number from a banner and grants remote control |
| Rootkit | Hides processes, files, and itself from the OS and tools | User-mode, kernel-mode, bootkit or firmware | Task Manager looks clean while another sensor still sees a command-and-control beacon |
| Backdoor | Covert access that bypasses normal authentication | Planted after compromise, or left as a vendor "support" account | Unexpected listening port, hidden local admin, scheduled task that re-creates access |
| Trapdoor | Undocumented entry point, classically built in by a developer | Source-level or debug path that never got removed | Maintenance account that ignores the identity provider |
| Fileless | Little or no new executable on disk; lives in memory, registry, Windows Management Instrumentation (WMI), or scripts | Living-off-the-land binaries (LOLBins) such as PowerShell, rundll32, mshta, certutil | Encoded PowerShell spawned by Office; disk scanners report clean |
Trapdoor versus backdoor. Older literature uses trapdoor for an undocumented developer path (a debug login compiled into an application) and backdoor for covert access an attacker installs. The SSCP outline lists both. If the stem says a programmer left an undocumented maintenance account, that is a trapdoor. If the stem says the attacker added a hidden service after phishing, that is a backdoor. Both bypass normal authentication. Neither is "just a virus."
Virus, worm, and trojan — the triad that still shows up on CAT items
A virus needs a host. Macro viruses live in documents; file infectors prepend or append to executables; boot-sector viruses hit the boot record. Cleaning "the virus" without replacing or restoring the host object leaves the infection in place.
A worm does not need a host file. It is a self-contained program that copies itself to the next vulnerable service. WannaCry (2017) is the teaching example of a worm that carried a ransomware payload: the replication method was worm-like (SMBv1 EternalBlue); the business impact was ransomware. On the exam, name the behavior the stem describes, not the brand.
A trojan does not replicate itself. The user (or a software supply-chain installer) runs it because it looks useful. Remote-access trojans, fake codecs, and invoice attachments with a double extension are classic. If the stem emphasizes disguise and user execution with no self-propagation, answer trojan.
Ransomware, scareware, and spyware
Ransomware is extortion malware. Crypto-ransomware encrypts files; locker ransomware blocks the desktop. Modern operators steal data first (double extortion) so that restoring from backup does not end the incident. Paying is a legal, cyber-insurance, and executive decision — not an SSCP "remediation step." Operationally you still isolate, preserve evidence if required, and restore from a known-clean copy.
Scareware is social engineering wearing a malware costume: a full-screen alert claims the PC is infected and demands a credit card or a phone call. The payload may be fake antivirus that is spyware, or a remote-support session that becomes a backdoor. Treat the pop-up as untrusted.
Spyware is about confidentiality: keyloggers, infostealers, stalkerware, and aggressive helpers that harvest credentials or personally identifiable information (PII). It may arrive as a trojan or as a "free" browser helper. Countermeasures overlap with data loss prevention (DLP) and secure browsing, but identification still starts with what is leaving the host.
Rootkits and why local scanners lie
A rootkit's job is to make other malware (and itself) invisible to the local OS: hooking system calls, hiding directories, tampering with process lists. User-mode rootkits are easier to catch with a clean EDR agent. Kernel-mode implants and bootkits require offline imaging, a known-good kernel, or firmware inspection. If local antivirus says clean but network sensors still see a command-and-control (C2) beacon from that host, suspect a rootkit or fileless implant, not a healthy endpoint.
Fileless malware: the PowerShell scenario
Fileless malware minimizes on-disk artifacts. The outline lists it separately because signature scanners that only inspect files will miss it.
Scenario. You are the security administrator for a regional clinic. A receptionist opens a macro-enabled document from a patient-looking email. The on-demand file scan of the document is inconclusive. EDR shows the word processor spawning powershell.exe with a hidden window and a long encoded command. No new executable is written under Downloads. Script-block logging, if enabled, shows the interpreter downloading a reflective loader into memory and then performing credential access against the local security authority process.
That is fileless tradecraft using a living-off-the-land interpreter. Containment is isolate the host and kill the PowerShell tree — not "wait for the weekly on-demand scanner." Remediation includes revoking the user's tickets, checking for WMI or scheduled-task persistence (fileless does not mean no persistence), and a software-security fix: disable Office macros from the internet, enable Antimalware Scan Interface (AMSI) and Constrained Language Mode where the business allows, and allowlist which scripts can run.
Application, code, OS, and mobile-code vulnerabilities
Malware is often the payload. The hole is a vulnerability:
| Surface | Example hole | What the attacker drops |
|---|---|---|
| Application | Unpatched thick client, vulnerable library, insecure update channel | Trojanized installer, macro, malicious plugin |
| Code | Injection (SQL, command), insecure deserialization, buffer overflow | Webshell, in-memory loader |
| Operating system | Missing patches, SMBv1 left on, local privilege escalation | Worm, ransomware, rootkit |
| Mobile code | Browser scripts, legacy ActiveX, sideloaded mobile packages, configuration profiles | Drive-by download, malicious profile that installs a backdoor |
Mobile code in SSCP language is code that moves to the endpoint to execute — JavaScript in the browser, macros, mobile app packages — not only phones. Phone-specific administration (mobile device management (MDM), corporate-owned versus bring-your-own) is knowledge area 7.3. Here the point is: untrusted code running in a trusted process is still malware delivery.
Malware countermeasures
The outline's countermeasure examples are scanners, anti-malware, containment and remediation, and software security. Match the control to the malware's behavior.
| Countermeasure | What it is good for | Failure mode |
|---|---|---|
| Scanners (on-demand or scheduled) | Known file hashes, unpacking common packers, offline rescue scans when a rootkit may be hiding live tools | Fileless memory implants; never-before-seen packing; scanners the rootkit can hide from |
| Anti-malware (real-time, cloud reputation, heuristics) | Blocks known and suspicious executables at write or execute | Users disable it "to install a driver"; it is not a substitute for isolation during an outbreak |
| Containment and remediation | Isolate the host or virtual LAN, block C2, disable the account, remove persistence, restore known-clean state | Cleaning one file while the worm is still on the production network; restoring an infected backup |
| Software security | Patching, least privilege, application allowlisting, disabling macros and unsigned scripts, secure configuration | Buying another scanner while Office still runs internet macros as the receptionist |
Containment for malware is the same discipline as incident response knowledge area 4.1: stop spread first. Use EDR network isolation or disable the virtual network interface; disable the compromised identity; block the C2 domain or address at the firewall. Do not power off if memory must be captured for fileless or rootkit analysis.
Remediation is eradication plus a trustworthy rebuild: remove the binary, the scheduled task, the WMI subscription, the rogue local admin, and close the hole. If you cannot trust the volume (rootkit, firmware, ransomware), rebuild from a gold image rather than cleaning in place.
Software security is why the clinic still gets hit next month if you only delete the malicious document. Disable macros from the internet, apply the Office and OS patches, take local admin from the receptionist, and allowlist PowerShell to signed operations scripts. Scanners without software security are a treadmill.
Exam traps. Calling a self-propagating encryptor "only a virus." Treating a fake antivirus pop-up as a scanner finding. Assuming fileless means no persistence, so a reboot is remediation. Paying ransomware as the documented countermeasure. Using a local scanner as proof a rootkit is absent. When the stem gives you encoded PowerShell and a clean disk scan, name fileless malware and containment plus software security, not "close the ticket."
A clinic receptionist opens a macro-enabled document. Endpoint telemetry shows the word processor spawning hidden, encoded PowerShell. No new executable is written to disk, and the on-demand file scanner reports clean. What is the correct analysis for SSCP knowledge area 7.1?
Which statement correctly distinguishes malware types listed in SSCP knowledge area 7.1?
Ransomware has encrypted a department share from a workstation. Signature antivirus did not alert. What countermeasure sequence matches the SSCP outline?