• I. Infection spread to 400 devices across multiple subnets within 30 minutes without any users opening attachments.
• II. A ransom note demanding cryptocurrency appeared on every infected desktop.
• III. The malware made no attempt to encrypt files — it simply copied itself to every reachable system.
• IV. The initial infection vector was an unpatched SMB service exposed to the internal network.

FILELESS MALWARE DETECTION - DRAFT
Step 1: Run full antivirus scan of the hard drive for known signatures.
Step 2: Check memory for suspicious PowerShell / WMI processes.
Step 3: Review EDR behavioral alerts for unusual child-process chains.
Step 4: Capture a memory dump before rebooting the machine.

• (A) Step 1 — signature-based disk scans are the wrong primary tool for fileless malware because the malicious code is never written to disk.
• (B) Step 2 — PowerShell and WMI are legitimate tools, so they should never be treated as suspicious.
• (C) Step 3 — EDR cannot see child-process chains.
• (D) Step 4 — a memory dump is unnecessary because fileless malware leaves no forensic artifacts anywhere.

• (A) Signature-based detection is faster but blind to zero-days; behavioral detection catches novel threats but generates more false positives that require analyst time to triage.
• (B) Behavioral detection is always more accurate than signature-based detection in every dimension, so there is no meaningful tradeoff.
• (C) Signature-based detection runs in memory, while behavioral detection runs on disk, so they cannot coexist on the same endpoint.
• (D) Both approaches require the same amount of analyst review, so the decision is purely about licensing cost.

• (A) Phishing email — users received a fake update notification.
• (B) Drive-by download — devices visited a compromised website.
• (C) Supply-chain attack — the legitimate update mechanism was compromised upstream, so a signed & trusted update delivered the malware.
• (D) Infected removable media — USB drives distributed the malware.