Certified Ethical Hacker (CEH) System Hacking and Malware Threats Syllabus

What are Windows registry Run keys used for by attackers maintaining access?

Run/RunOnce registry keys (e.g., HKLM/HKCU ...\CurrentVersion\Run) auto-execute programs at user logon or boot, so attackers add entries there to achieve persistence for their malware.

What is a keylogger, and what are its two main types?

A tool that records keystrokes to capture passwords and other input. Hardware keyloggers are physical devices inserted between keyboard and computer; software keyloggers are programs that hook the keyboard input at the OS or application level.

What is steganography, and how does it differ from cryptography?

Steganography hides the existence of a message by concealing it within another file (image, audio, video). Cryptography hides the meaning of a message by scrambling it. Steganography conceals that communication occurred; cryptography conceals content.

What is the LSB (Least Significant Bit) technique in image steganography?

Hidden data is stored by replacing the least significant bit of each pixel's color value. Because changing the LSB alters color imperceptibly, data can be embedded in an image with no visible difference.

What is steganalysis?

The practice of detecting, and ideally extracting, hidden data concealed by steganography. It analyzes files for statistical anomalies, size/format irregularities, or known stego signatures to reveal covert payloads.

On Windows NTFS, how can attackers hide data using Alternate Data Streams (ADS)?

NTFS allows a file to have additional hidden streams (e.g., file.txt:hidden.exe). Attackers store executables or data in an ADS that does not appear in normal directory listings or affect the host file's visible size.

Why do attackers clear logs, and which Windows logs are key targets?

To erase evidence of their intrusion and avoid detection/forensics. Key targets are the Windows Event Logs: Security, System, and Application logs (managed via the event log service, e.g., wevtutil/clearev).

What is 'covering tracks' in the system hacking methodology?

The final phase where the attacker removes evidence of the compromise — clearing logs, disabling auditing, deleting tools and command history, hiding files, and altering timestamps — to avoid detection and hinder forensic investigation.

What is timestomping in anti-forensics?

Modifying a file's MAC (Modified, Accessed, Created) timestamps to blend a malicious file in with legitimate files or to mislead investigators about when activity occurred.

What is the difference between disabling auditing and clearing logs when covering tracks?

Disabling auditing (e.g., 'auditpol /disable') stops new events from being recorded going forward, so future actions leave no trace. Clearing logs deletes already-recorded events. Attackers often disable auditing first, then clear existing logs.

What is malware? Give the general definition used in CEH.

Malware (malicious software) is any program or code designed to damage, disrupt, steal, or gain unauthorized access to systems or data. It includes viruses, worms, trojans, ransomware, spyware, rootkits, and more.

What is a malware dropper versus a downloader?

A dropper contains the malicious payload embedded inside it and releases (installs) it on the target. A downloader contains no payload itself; it connects to a remote server to download and execute the malware after running.

What are common malware distribution techniques?

Phishing/spear-phishing email attachments and links, malicious websites and drive-by downloads, malvertising, infected USB/removable media, software bundling and trojanized downloads, exploit kits, and watering-hole attacks.

What is a drive-by download?

Malware that is automatically downloaded and installed when a victim merely visits a compromised or malicious website, exploiting browser or plugin vulnerabilities without requiring the user to click or consent.

What is a Trojan horse in malware terms?

Malware disguised as legitimate or desirable software that tricks the user into running it. Unlike viruses/worms, a trojan does not self-replicate; it relies on social engineering for execution and then performs hidden malicious actions.

What is the difference between a forward (direct) connection and a reverse connection trojan/shell?

In a direct/bind connection, the attacker connects inbound to a port the malware opened on the victim. In a reverse connection, the victim's malware initiates an outbound connection to the attacker, which more easily bypasses firewalls/NAT.

What is a RAT (Remote Access Trojan)?

A trojan that gives an attacker full remote control over an infected machine — file access, keylogging, webcam/microphone capture, screen viewing, and command execution — typically via a covert command-and-control channel.

What is a covert channel, and how do trojans use it?

A covert channel transfers information using methods not intended for communication, evading security controls. Trojans use covert channels (e.g., tunneling data over ICMP, DNS, or HTTP) to exfiltrate data and reach command-and-control undetected.

What is a computer virus, and what is required for it to spread?

A self-replicating program that attaches itself to a host file or program and inserts copies of its code into other files. It requires a host and user/system action (running the infected file) to execute and propagate.

How does a worm differ from a virus?

A worm is self-replicating malware that spreads independently across networks without needing a host file or user action, often exploiting vulnerabilities to propagate automatically. A virus needs a host file and user execution to spread.

What is a polymorphic virus?

A virus that changes (mutates) its own code/appearance with each infection — typically by encrypting its body with a varying key and using a mutating decryptor — to evade signature-based antivirus detection while keeping the same functionality.

What is a metamorphic virus, and how does it differ from a polymorphic virus?

A metamorphic virus rewrites its entire code body on each infection (changing instructions while preserving behavior), with no constant decryptor. A polymorphic virus keeps the same underlying code but encrypts it differently each time using a mutating decryptor.

What is a macro virus?

A virus written in the macro language of an application (e.g., VBA in Microsoft Word/Excel) that infects documents and runs when the document is opened with macros enabled, spreading through shared documents.

What is a stealth (tunneling) virus?

A virus that actively hides its presence by intercepting system calls and returning clean/uninfected information to antivirus and the OS, so scans of infected files appear normal.

What is fileless malware?

Malware that operates in memory without writing a malicious executable to disk, often abusing legitimate tools (PowerShell, WMI, scripts) and 'living off the land.' Its lack of disk artifacts makes signature-based detection difficult.

What does 'living off the land' (LOLBins) mean in advanced threats?

Attackers use legitimate, preinstalled OS tools and binaries (e.g., PowerShell, WMIC, certutil, mshta, regsvr32) to carry out malicious actions, blending in with normal activity and avoiding the need to drop detectable custom malware.

What is an Advanced Persistent Threat (APT)?

A stealthy, well-resourced (often state-sponsored) adversary that gains long-term, persistent access to a target network to continuously exfiltrate data or conduct espionage, using sophisticated, low-and-slow techniques to avoid detection.

What is the difference between static and dynamic malware analysis?

Static analysis examines the malware without executing it (inspecting strings, headers, hashes, disassembly). Dynamic (behavioral) analysis runs the malware in a controlled sandbox to observe its actual behavior — files, registry, network, and process activity.

Why is sheep dip (dedicated isolated) analysis used for suspected malware?

A 'sheep dip' computer is an isolated, dedicated, instrumented system used to test/scan suspect files before they touch the production network, containing any infection and capturing behavior safely.

What is the main weakness of signature-based malware detection, and what addresses it?

Signature-based detection cannot catch new, unknown, or obfuscated (polymorphic/metamorphic/fileless) malware that lacks a known signature. Heuristic and behavior-based detection (and sandboxing) address this by flagging suspicious behavior rather than known patterns.

What are key countermeasures against trojans and backdoors?

Use updated antivirus/EDR, monitor for unusual open ports and outbound connections, apply application allowlisting, scan downloads, avoid untrusted software, use host/network firewalls and integrity checking, and verify file hashes/signatures.