Stealth, Persistence, and Deep Compromise Malware for A+
Short answer
Stealth/persistence malware aims to survive ordinary cleanup and to hide from tools. A support technician should identify indicators: mismatch between observed behavior and what signature scanners report, early-boot failures or manipulation, memory-resident suspicious processes, or signs of covert surveillance. These signs typically require escalation to specialized detection (EDR) or full system rebuilds.
Why it appears on the exam
- Identify from a short scenario that a fileless technique is likely (e.g., PowerShell launch + no disk artifact). - Decide whether to escalate to EDR/MDR or to schedule an OS rebuild based on described indicators (e.g., rootkit signs).
Key concepts
Concept 1
Required terms
Rootkit: Malware designed to conceal its presence by modifying low-level OS components, drivers, or kernel modules to hide processes, files, or registry entries. Boot sector virus: Malware that infects the boot sector or Master Boot Record so it runs early in the boot process and can persist prior to OS load. Fileless malware: Malware that runs in memory or uses legitimate system tools (script interpreters, PowerShell, WMI) without leaving persistent files on disk. Stalkerware: Software installed to surveil a user's activities (location, messages, camera/microphone) often on personal devices, frequently used in abusive situations.
Example
Rootkit: System services appear to stop but task manager and file listings do not show the responsible process; kernel-mode driver tampering suspected.
Concept 2
How Stealth, Persistence, and Deep Compromise Malware works
Stealth/persistence malware aims to survive ordinary cleanup and to hide from tools. A support technician should identify indicators: mismatch between observed behavior and what signature scanners report, early-boot failures or manipulation, memory-resident suspicious processes, or signs of covert surveillance. These signs typically require escalation to specialized detection (EDR) or full system rebuilds.
Example
Boot sector virus: Machine refuses to boot to OS and displays boot-sector error after using a shared external drive.
Concept 3
Common confusion
- Believing a clean AV scan proves no compromise; many stealth threats evade signature-based scans. - Treating fileless behavior as harmless; fileless threats can be highly persistent and evade traditional scanning. - Confusing corporate MDM/monitoring with stalkerware; focus on consent and installation context.
Example
Fileless malware: PowerShell commands run at login that contact external IPs without disk-resident payloads.
Concept 4
Core 2 (220-1202) question cues
Identify from a short scenario that a fileless technique is likely (e.g., PowerShell launch + no disk artifact); Decide whether to escalate to EDR/MDR or to schedule an OS rebuild based on described indicators (e.g., rootkit signs).
Example
Stalkerware: A phone reports its location to an unknown account; a stealthy app with camera/microphone permissions is present.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.An A+ support scenario describes this situation: Rootkit: System services appear to stop but task manager and file listings do not show the responsible process; kernel-mode driver tampering suspected. Which answer fits best?
Q2.A technician sees this situation: Boot sector virus: Machine refuses to boot to OS and displays boot-sector error after using a shared external drive. Which answer should they choose?
Q3.Read this A+ scenario: Fileless malware: PowerShell commands run at login that contact external IPs without disk-resident payloads. Which term or action matches it?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8