QuestionQ715

Endpoint Attack and Pivoting

How might an attacker insert malware into the kernel of a Windows system?

  • A By altering the kernel file sysLinux and changing file attributes to read write
  • B By installing and executing a remote listener on the target system
  • C By altering the file Ntoskrnl.exe and the NTLDR
  • D By altering the file nt.dll and including it in the executable path
Explanation

Ntoskrnl.exe is the Windows NT kernel image. Altering it, together with the legacy NTLDR boot loader that loads the operating system during startup, can cause malicious kernel-resident code to be loaded as part of the boot process.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!