GCIH: Malware, Persistence & Lateral Movement

Malware, Persistence & Lateral Movement

The final GCIH topic covers the full attacker lifecycle after initial access — how malware operates, how attackers stay in your environment, and how they move laterally to reach their objectives.

GCIH · Topic 5 of 5 · ~106 Questions · 4 Hours

Core Concepts at a Glance

Malware Taxonomy

Eleven distinct malware types — viruses, worms, trojans, RATs, rootkits, ransomware, keyloggers, backdoors, botnets, droppers, and spyware — each with a unique delivery model and behavioral signature. Know which requires a host file and which self-replicates.

C2 Infrastructure

Command and Control (C2) channels let attackers communicate with compromised hosts. Key mechanisms: HTTPS beaconing with jitter, DNS tunneling, DGA (Domain Generation Algorithm), and domain fronting via CDNs. Cobalt Strike and Sliver are common frameworks.

Windows Persistence

Registry Run keys, Startup folders, Scheduled Tasks, Services, DLL Hijacking, WMI Subscriptions, COM Hijacking, and LOLBins are all tested. Autoruns (Sysinternals) is the gold-standard tool for enumerating all persistence locations on a Windows system.

Linux Persistence

Cron jobs, systemd services, .bashrc/.bash_profile injection, SSH authorized_keys, SUID binaries, LD_PRELOAD hijacking, and /etc/ld.so.preload are the primary Linux persistence mechanisms. Each provides a distinct execution trigger and detection method.

Lateral Movement Techniques

Pass-the-Hash uses NTLM hashes directly — no cracking needed. Pass-the-Ticket and Golden/Silver Tickets abuse Kerberos. Kerberoasting extracts and cracks service ticket hashes offline. Remote execution via PsExec, WMI, PowerShell remoting, and RDP round out the toolkit.

IOC Identification & YARA

YARA is the pattern-matching standard for malware identification — scan files, processes, and memory. Volatility is the standard memory forensics framework: pslist, netscan, malfind, and dlllist are the four most-tested plugins. Malfind identifies process injection.

Exam Tips

PtH vs PtT vs Golden Ticket

The GCIH exam loves to test these three. PtH uses NTLM hashes (no Kerberos). PtT steals existing Kerberos tickets. Golden Ticket forges a TGT using the krbtgt hash — giving 10-year domain persistence. Know what artifact each attack requires and what it bypasses.

Malware Identification Traps

Virus requires a host file and user action to spread. Worm self-replicates with no host file. Trojans disguise as legitimate software. Rootkits hide their own presence. Ransomware destroys availability. The exam distinguishes these — memorize the defining characteristic of each.

YARA + Volatility for Memory

Malfind is the Volatility plugin for finding injected code — it looks for executable memory regions not backed by a file on disk (MZ header present but no file mapping). YARA rule structure: meta (info) → strings (patterns) → condition (logic). Both are exam-ready topics.

Malware Types & C2 Infrastructure

Understand how each malware category operates, what makes it distinct, and how attackers build and hide their command-and-control channels.

Malware Taxonomy

Type	Definition	Key Characteristic	Example
Virus	Attaches to files; spreads via user action	Requires host file	ILOVEYOU
Worm	Self-replicating; spreads via network	No host file needed	WannaCry, Conficker
Trojan	Disguised as legitimate software	Social engineering delivery	RAT disguised as game
RAT (Remote Access Trojan)	Full remote control of victim	Keylogging, screen capture, file access	njRAT, DarkComet
Rootkit	Hides attacker presence; kernel or user mode	Subverts OS; very hard to detect	TDSS, Azazel
Ransomware	Encrypts files; demands payment	Destroys availability	WannaCry, REvil, Conti
Keylogger	Records keystrokes	Credential theft	Ardamax
Backdoor	Persistent unauthorized access channel	Often combined with RAT	Web shell
Botnet/Bot	Compromised device under C2 control	Used for DDoS, spam, cryptomining	Mirai, Emotet
Dropper/Loader	Delivers and installs other malware	First stage	TrickBot loading Ryuk
Spyware	Monitors and exfiltrates user activity	Stalkerware variant	Pegasus

Command & Control (C2) Infrastructure

C2 purpose: attacker communicates with compromised hosts — issue commands, receive exfiltrated data, deliver additional payloads
Beacon: malware periodically checks in with C2; beacon interval + jitter (random delay variation) used to avoid pattern detection
HTTPS: blends with normal web traffic; encrypted payload hides commands; hardest to detect at network layer
DNS tunneling: encode data in DNS queries/responses — hard to block without disrupting legitimate DNS resolution
ICMP tunneling: embed data in ICMP echo request/reply payload
Social media APIs: Twitter DMs, GitHub issues, Slack/Discord webhooks used as covert C2 channels — traffic looks like normal SaaS use
Domain fronting: route C2 traffic through CDN (Cloudflare, AWS CloudFront) so traffic appears destined for a legitimate CDN; largely mitigated by major CDN providers
DGA (Domain Generation Algorithm): malware generates hundreds of random domains daily — attacker registers only one; defender can't block them all. Detect via: high NXDOMAIN response rate, high domain entropy (random-looking strings)
C2 frameworks: Cobalt Strike (most common commercial), Metasploit, Empire (PowerShell), Sliver, Brute Ratel

Malware Analysis Types

Static Analysis

Examine malware without executing it. Techniques: file hashing (MD5/SHA-256), strings extraction, PE header analysis, import table inspection, YARA scanning. Tools: strings, PEStudio, Ghidra (disassembly), IDA Pro. Safe — no execution risk.

Dynamic Analysis

Execute in a controlled sandbox and observe behavior: file writes, registry changes, network connections, process creation. Tools: Cuckoo, Any.run, VirusTotal dynamic, Wireshark (network), Process Monitor (host). Risk: malware may detect sandbox and alter behavior.

Hybrid Analysis

Combines static and dynamic: use static first for quick triage (hash lookup, strings, YARA), then dynamic for behavioral confirmation. Most professional workflows use both — static for speed, dynamic for depth. x64dbg used for live debugging during dynamic phase.

Persistence Mechanisms

Attackers establish persistence so they survive reboots and credential changes. Know every location — on both Windows and Linux — and how to detect each one.

Windows Persistence Mechanisms

Mechanism	Location / Method	Detection
Registry Run Keys	`HKCU\...\Run`, `HKLM\...\Run`, `RunOnce`	Autoruns, `reg query`
Startup Folder	`C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`	Autoruns, file monitoring
Scheduled Tasks	`schtasks /create`; Task Scheduler GUI	`schtasks /query`, Event ID 4698
Services	`sc create`; `HKLM\SYSTEM\CurrentControlSet\Services`	`sc query`, Autoruns
DLL Hijacking	Place malicious DLL earlier in app search path than legitimate DLL	ProcMon "DLL not found", Sigcheck
WMI Subscriptions	`__EventFilter` + `__EventConsumer` + `__FilterToConsumerBinding`	`Get-WMIObject`, WMI-Activity event log
Boot/Pre-OS	Bootkit in MBR/VBR/UEFI	Boot integrity checks, Secure Boot
COM Hijacking	Override COM object CLSID in `HKCU` registry	ProcMon, Autoruns
LOLBins	regsvr32, mshta, certutil, bitsadmin — legitimate Windows binaries abused	Behavioral monitoring, application whitelisting

Key Windows Artifacts for Persistence Detection

Autoruns (Sysinternals): comprehensive persistence location scanner — the gold standard; scans Run keys, startup folders, services, scheduled tasks, browser extensions, WMI, and more in a single tool
Event ID 4698: scheduled task created
Event ID 7045: new service installed on the system
Event ID 4720: user account created (persistence via new local admin)
Sysmon Event ID 1: process create (captures command line, parent process)
Sysmon Event ID 3: network connection initiated by process
Sysmon Event ID 7: DLL image loaded (detect DLL hijacking)
Sysmon Event IDs 12/13: registry key create/set — captures Run key modifications in real time

Linux Persistence Mechanisms

Cron jobs: /etc/crontab, /etc/cron.d/, /var/spool/cron/crontabs/root — example: * * * * * /tmp/backdoor executes every minute
Systemd services: drop malicious .service file in /etc/systemd/system/ — survives reboots and restarts automatically
.bashrc / .bash_profile / .profile: inject code that executes every time a user opens an interactive shell or logs in
/etc/rc.local: legacy script executed at boot (still present on many systems)
SSH authorized_keys: add attacker's public key to ~/.ssh/authorized_keys — provides password-free persistent SSH access
SUID binaries: chmod u+s on a binary — executes as file owner (often root) regardless of who runs it
LD_PRELOAD: set environment variable to preload malicious shared library that hooks legitimate function calls
/etc/ld.so.preload: system-wide library preloading — applies to every dynamically linked process on the system

Lateral Movement

After gaining initial access, attackers pivot to additional systems. Master the credential-based and remote execution techniques — and their detection signatures — for the GCIH exam.

Credential-Based Techniques

Pass-the-Hash (PtH): use captured NTLM hash to authenticate without knowing the plaintext password. Tools: Mimikatz (sekurlsa::pth), CrackMapExec, Impacket (psexec.py, wmiexec.py). Windows 8.1+ KB2871997 limits PtH for some accounts; local Administrator accounts still vulnerable if the same hash is reused across hosts.
Pass-the-Ticket (PtT): steal an existing Kerberos TGT or service ticket from memory, inject it into the current session. Tool: Mimikatz (kerberos::ptt).
Golden Ticket: forge a TGT using the krbtgt hash — valid for the entire domain for up to 10 years. Requires domain controller compromise to obtain krbtgt hash. Defense: rotate krbtgt password twice (two versions are kept).
Silver Ticket: forge a service ticket using a service account hash — no DC contact required during the attack, so no domain-side logging. More targeted than Golden Ticket.
Kerberoasting: any authenticated user can request service tickets for accounts with SPNs. Tickets encrypted with service account password hash — crack offline with Hashcat. Target: service accounts with weak passwords. Indicator: Event ID 4769 with encryption type 0x17 (RC4).
AS-REP Roasting: targets accounts with "do not require Kerberos preauthentication" set — obtain AS-REP response containing hash, crack offline. No credentials required to initiate.
Overpass-the-Hash: convert an NTLM hash into a valid Kerberos TGT — better operational security than PtH because subsequent traffic uses Kerberos rather than NTLM.
Honey credentials: fake domain admin accounts that never legitimately log in — any authentication event = immediate alert. Highly effective detection control.

Remote Execution Techniques

PsExec: creates a service on the remote host to execute commands; leaves artifacts (service creation Event ID 7045, named pipe over \ADMIN$)
WMI/WMIC: wmic /node:target process call create "cmd.exe"; uses Win32_Process; Event ID 4648 (logon using explicit credentials), WMI-Activity log
PowerShell Remoting: Invoke-Command -ComputerName target -ScriptBlock {...}; Event IDs 4103/4104 (Script Block logging captures executed code)
RDP (Remote Desktop Protocol): port 3389; Event ID 4624 logon type 10 (RemoteInteractive); TS gateway logs; watch for brute force attempts and unusual source IPs
SMB: file share access; PsExec uses \ADMIN$; monitor for unusual share access (Event ID 5140)
DCOM: Windows management via COM objects; used by Impacket's dcomexec.py; lower visibility than PsExec in many environments

Detection of Lateral Movement

Logon type analysis: Type 3 = network logon; Type 10 = RDP — look for unusual source IPs and off-hours access patterns
Mimikatz detection: LSASS access events (Event IDs 4656/4663), EDR signatures for credential dumping behavior
Unusual service creation: Event ID 7045, especially with random or suspicious names — hallmark of PsExec-style tools
East-west traffic spikes: internal hosts connecting to many other internal hosts rapidly — scanning or worm-like spreading behavior
Ticket anomalies: Kerberos tickets with unusual PAC data, encryption type 0x17 (RC4) for service tickets — Kerberoasting indicator
Kerberos Event ID 4769: service ticket requested — high volume with RC4 encryption type indicates Kerberoasting in progress

YARA Rules

YARA purpose: pattern-matching tool for malware identification on files, processes, and memory dumps
Rule structure: rule RuleName { meta: author="analyst" strings: $s1 = "malicious_string" $hex = {DE AD BE EF} condition: $s1 or $hex }
meta section: informational (author, date, description) — not used in matching logic
strings section: define text strings, hex sequences, or regular expressions to search for
condition section: boolean logic determining when the rule fires (e.g., all of them, 2 of ($s*), filesize < 1MB and $hex)
Use cases: scan file systems for known malware families, identify C2 beacon patterns in memory, classify malware variants in triage
Rule sources: VirusTotal YARA community, Florian Roth's signature-base (GitHub), CAPE sandbox output, custom threat intel

Memory Forensics (Volatility)

Volatility framework: analyze raw memory dumps from Windows, Linux, or macOS systems
pslist / pstree: enumerate running processes from the PsActiveProcessHead list — can miss unlinked (hidden) processes
psscan: scan memory for EPROCESS structures — finds unlinked processes hidden from pslist (rootkit evasion)
netscan: enumerate active and recently closed network connections (TCP/UDP) — reveals C2 connections
dlllist: list DLLs loaded by each process — look for unexpected DLLs in legitimate processes
malfind: identify potentially injected code — finds executable memory regions with MZ headers not backed by a file on disk (hallmark of process injection and shellcode)
cmdline: show command-line arguments used to start each process — reveals malicious flags and execution paths
filescan: enumerate open file handles across all processes
Hollow process indicator: legitimate process name, but image path points to wrong location, or memory is VAD-backed executable without file mapping

Memory Hooks

Six sticky mnemonics to lock in the most-tested concepts from this topic before exam day.

🦠

Malware Taxonomy

"Virus=needs host · Worm=self-spreads · Trojan=fake legit · RAT=full control · Rootkit=hides itself · Ransomware=encrypts files"

Each type has ONE defining trait. Virus requires a host file. Worm needs no host. Trojan relies on deception. RAT gives the attacker full interactive control. Rootkit subverts the OS to hide itself. Ransomware destroys availability for profit.

📡

C2 Channels

"HTTPS=blends in · DNS tunneling=hard to block · DGA=rotating domains · Cobalt Strike beacon=jitter to avoid pattern detection"

C2 hides by looking like legitimate traffic. HTTPS blends with web browsing. DNS tunneling is hard to block without breaking DNS. DGA makes blocking impossible with a static list. Jitter randomizes beacon timing so regularity doesn't expose the malware.

🔑

Windows Persistence Hotspots

"Run keys · Startup folder · Scheduled tasks · Services · DLL hijack · WMI subscriptions — Autoruns finds them all"

These six are the most-tested Windows persistence locations. Each has different trigger timing: Run keys and Startup folder fire at logon. Scheduled Tasks fire on time/event. Services fire at boot. WMI subscriptions fire on any configured event. Autoruns (Sysinternals) checks all of them.

🎫

Pass-the-Hash vs Pass-the-Ticket

"PtH=NTLM hash used directly (no crack needed) · PtT=Kerberos ticket injected · Golden Ticket=fake TGT from krbtgt hash (10yr validity)"

PtH bypasses Kerberos entirely — pure NTLM. PtT steals an existing Kerberos ticket from memory. Golden Ticket forges a brand-new TGT using the krbtgt hash — the ultimate domain persistence. Remember: rotate krbtgt TWICE (two versions are cached) to invalidate it.

🔬

YARA Rule Structure

"rule name { strings: $s='evil' condition: $s }" — meta=info, strings=patterns, condition=logic. Scan files, memory, processes for malware."

Three sections: meta (human info, not used in matching), strings (text, hex, regex patterns), condition (boolean logic). Hex patterns use curly braces: {DE AD BE EF}. Wildcards allowed: {DE ?? BE EF}. YARA can scan live process memory — critical for memory forensics triage.

🧠

Memory Forensics

"Volatility: pslist=processes · netscan=connections · malfind=injected code · dlllist=loaded DLLs · cmdline=process arguments"

Volatility is the memory forensics standard. pslist uses the OS-linked list (rootkits can unlink). psscan finds them anyway by scanning raw memory. malfind is the injection detector — looks for MZ headers in non-file-backed executable memory regions. This pattern = process injection or shellcode.

Flashcards & Study Advisor

Click any card to flip and reveal the answer. Use the Study Advisor to get targeted guidance on each topic area.

Click a card to flip it · Click again to flip back

Worm vs Virus vs Trojan

Replication mechanism, delivery, and host file requirement for each

Virus: requires host file, spreads via user action (opening infected file). Worm: self-replicates, no host file needed, spreads autonomously via network. Trojan: disguised as legitimate software, relies on social engineering for delivery — does NOT self-replicate.

PtH vs PtT vs Golden Ticket

What credential/artifact is used and what each bypasses

PtH: NTLM hash → authenticate without plaintext (bypasses Kerberos entirely). PtT: stolen Kerberos TGT/service ticket injected into session (bypasses password auth). Golden Ticket: forged TGT from krbtgt hash — bypasses DC, valid 10 years, survives password resets on all other accounts.

Kerberoasting

Target accounts, attack mechanics, and detection signature

Any authenticated user requests service tickets for SPN-linked accounts. Ticket encrypted with service account's password hash. Attacker cracks offline (no lockout, no DC alerts). Detection: Event ID 4769 with encryption type 0x17 (RC4) — modern accounts use AES, so RC4 requests are suspicious.

Windows Run Key Locations

HKCU vs HKLM, execution trigger, and detection tool

HKCU\Software\Microsoft\Windows\CurrentVersion\Run: runs at current user logon. HKLM\Software\Microsoft\Windows\CurrentVersion\Run: runs at any user logon (requires admin to set). RunOnce: executes once then deletes itself. Detection: Autoruns, reg query, Sysmon Event IDs 12/13.

C2 Beaconing & DGA

Beacon interval + jitter meaning, and why DGA defeats static blocking

Beacon interval: frequency of malware check-in (e.g., every 60s). Jitter: random variation added to interval (±20%) — prevents time-based pattern detection. DGA: generates hundreds of pseudo-random domains daily using a seed; attacker registers only one — defender can't block all possible future domains. Detect via high NXDOMAIN rate and high domain string entropy.

DLL Hijacking

Windows DLL search order, attacker placement, and detection method

Windows DLL search order: application directory → System32 → System → Windows → CWD → PATH. Attacker places malicious DLL with same name in a directory searched before the legitimate DLL. Application loads the malicious version. Detection: Process Monitor shows "NAME NOT FOUND" for DLL in earlier paths before successful load — indicates hijack opportunity. Sigcheck for signature verification.

YARA Rule Syntax

meta, strings, condition sections; hex syntax; memory scanning

meta: informational only (author, description). strings: $s1 = "evil_string" (text), $h = {DE AD BE EF} (hex, ?? for wildcard). condition: boolean logic — any of them / all of them / $s1 and filesize < 1MB. Use -p flag for process memory scanning. Multiple strings increase specificity and reduce false positives.

Volatility malfind

What it looks for, what it indicates, and the underlying mechanism

malfind looks for: VAD (Virtual Address Descriptor) regions marked executable but NOT backed by a file on disk — and containing an MZ header (PE signature). Indicates: process injection (DLL injection, reflective DLL loading), shellcode injection, or process hollowing. Legitimate code is always backed by a file on disk — executable memory without a file mapping is a major red flag.

Study Advisor

Select a topic to get targeted study guidance for the GCIH exam.

Malware Types — Exam Strategy

The taxonomy distinctions are heavily tested: virus requires a host file and user action; worm needs neither — memorize this contrast cold
Rootkits are the evasion specialists — they modify the OS to hide their own presence; kernel-mode rootkits are harder to detect than user-mode
Dropper/loader chains are modern APT technique: TrickBot drops Ryuk; loader delivers the actual payload and may self-delete after execution
Ransomware IR response: isolate, preserve evidence (do NOT reboot), identify backup status, engage IR team, assess decryption options before paying
RATs provide interactive access including keylogging, screen capture, and file system access — distinguish from backdoors (which provide access channel only)
Know the difference between spyware (passive monitoring/exfiltration) and stalkerware (a spyware variant targeting domestic surveillance)

Malware, Persistence & Lateral Movement

Malware, Persistence & Lateral Movement

Core Concepts at a Glance

Malware Taxonomy

C2 Infrastructure

Windows Persistence

Linux Persistence

Lateral Movement Techniques

IOC Identification & YARA

Exam Tips

PtH vs PtT vs Golden Ticket

Malware Identification Traps

YARA + Volatility for Memory

Malware Types & C2 Infrastructure

Malware Taxonomy

Command & Control (C2) Infrastructure

Malware Analysis Types

Static Analysis

Dynamic Analysis

Hybrid Analysis

Persistence Mechanisms

Windows Persistence Mechanisms

Key Windows Artifacts for Persistence Detection

Linux Persistence Mechanisms

Lateral Movement

Credential-Based Techniques

Remote Execution Techniques

Detection of Lateral Movement

YARA Rules

Memory Forensics (Volatility)

Practice Quiz

Memory Hooks

Flashcards & Study Advisor

Study Advisor

Malware Types — Exam Strategy

Complete Your GCIH Preparation