60. A user downloads a patch from an unknown repository to update their device. After applying the patch, the system becomes unresponsive. An incident response team receives alerts sent by an FIM platform and indicates that the hashes of the operating system files have changed. Which of the following attacks most likely occurred?
Answer: D
The most likely attack that occurred is a rootkit.
A rootkit is designed to hide its presence on a system and can modify operating system files, which aligns with the scenario where the hashes of the operating system files have changed after applying the patch.
A) Logic bomb
A logic bomb is a piece of malicious code that triggers under specific conditions, but it does not inherently modify the operating system files or cause system unresponsiveness in the manner described. Therefore, this option does not fit the context of the incident.
B) Keylogger
A keylogger is primarily used to capture keystrokes and does not typically alter operating system files or lead to system unresponsiveness. The situation described is more severe than what a keylogger would typically cause.
C) Ransomware
Ransomware encrypts files and demands payment for decryption, which could lead to system unresponsiveness, but it would not specifically change the hashes of the operating system files as noted in the alerts from the FIM platform. Thus, ransomware is not the most appropriate choice.
D) Rootkit
A rootkit can operate at a low level within the system, allowing it to alter operating system files and evade detection, which matches the scenario where the system becomes unresponsive and the hashes of the files have changed. This aligns with the alerts from the FIM platform indicating unauthorized modifications.
Conclusion
The scenario clearly indicates that a rootkit is the most plausible explanation for the changes in operating system file hashes and the resulting system unresponsiveness. Other options, such as logic bombs, keyloggers, and ransomware, do not adequately account for the specific behaviors observed in this incident. Thus, the identification of a rootkit directly ties to the core issue of system integrity and unauthorized modifications.