Malware, Ransomware, and Endpoint Defense
Understanding malicious code
Malware basics
Malware is software built to harm, spy on, extort, or enable unauthorized access. Different malware families use different mechanisms, but many rely on persistence, evasion, and communication with external infrastructure.
Common malware behaviors
| Behavior | Why it matters |
|---|---|
| Persistence | Survives reboots or user logout |
| Privilege escalation | Gains more control on the host |
| Defense evasion | Avoids antivirus or monitoring |
| Command and control | Receives instructions from attackers |
Ransomware vs spyware
Ransomware
- Encrypts or locks data
- Extorts victims for payment
Spyware
- Secretly collects data
- Focuses on stealth and theft
Containment matters
The quickest way to reduce malware damage is often to isolate the affected device or account before the attacker can spread laterally.
Endpoint defenses
First response to suspected malware
-
1
Isolate the endpoint or account if safe to do so.
-
2
Preserve logs and evidence.
-
3
Identify scope: users, hosts, and data affected.
-
4
Remove persistence and reset exposed credentials.
-
5
Recover from known-good backups and monitor for recurrence.
What is the main purpose of persistence in malware?
Persistence helps malware survive normal restarts and removal attempts.
Correct answer: Remain active across reboots or logouts
Why are backups important in ransomware defense?
Good backups support recovery after extortion attempts.
Correct answer: They allow restoration without paying attackers and reduce the impact of encryption or deletion
Which defense most directly limits the ability to run unknown software?
Allowlisting restricts execution to approved applications.
Correct answer: Allowlisting
What does EDR help security teams do?
EDR is built for visibility and response, not just prevention.
Correct answer: Detect suspicious endpoint behavior and investigate or respond to incidents