Attackers exploit legitimate system packages installed in the system, such as Word and JavaScript, to run the malware. This is best described as using which category?

Attackers exploit legitimate system packages installed in the system, such as Word and JavaScript, to run the malware. This is best described as using which category?

• A. Memory code injection
• B. Legitimate applications
• C. Registry manipulation
• D. Malicious websites

Answer: (B)

Accessing malware through trusted software already on the system is about abusing legitimate applications to execute code. Attackers leverage tools that are considered safe and permissible by the system, such as Word or JavaScript, because these programs are trusted to run many kinds of tasks. By using them to run macros, scripts, or automation, the malware blends in with normal activity, making it harder for security controls that look for unknown executables to detect the threat. This is different from injecting code directly into memory of another process, which would be memory code injection, or from altering the registry for persistence, or from loading payloads via malicious websites. The essence is using legitimate, installed applications to carry out malicious actions.

Accessing malware through trusted software already on the system is about abusing legitimate applications to execute code. Attackers leverage tools that are considered safe and permissible by the system, such as Word or JavaScript, because these programs are trusted to run many kinds of tasks. By using them to run macros, scripts, or automation, the malware blends in with normal activity, making it harder for security controls that look for unknown executables to detect the threat. This is different from injecting code directly into memory of another process, which would be memory code injection, or from altering the registry for persistence, or from loading payloads via malicious websites. The essence is using legitimate, installed applications to carry out malicious actions.