To detect hidden or background software installs performed by malware, which tool is used?

To detect hidden or background software installs performed by malware, which tool is used?

• A. Installation monitoring
• B. Process Monitor
• C. Log analysis
• D. Splunk

Answer: (A)

Detecting stealthy malware installs hinges on watching what the system does in real time, especially when it comes to installing new components, writing to important directories, and modifying the registry. Process Monitor from Sysinternals provides detailed, live visibility into file system, registry, and process activity, including the exact files touched, registry keys created or changed, and the command lines used to launch processes. This makes it possible to spot an installer running in the background and understand exactly what it’s doing, even if it tries to hide from the user. Other options don’t offer the same immediate, granular view. Installation monitoring is a vague term without a specific, built-in tool to reveal actions in real time. Log analysis looks at events after they’ve been recorded, which may miss stealthy installs that don’t leave obvious traces or that occur before logs are generated. Splunk is a powerful log-collection and search platform, but it relies on having logs to ingest; it isn’t a direct, real-time detector of hidden install activity by itself.

Detecting stealthy malware installs hinges on watching what the system does in real time, especially when it comes to installing new components, writing to important directories, and modifying the registry. Process Monitor from Sysinternals provides detailed, live visibility into file system, registry, and process activity, including the exact files touched, registry keys created or changed, and the command lines used to launch processes. This makes it possible to spot an installer running in the background and understand exactly what it’s doing, even if it tries to hide from the user.

Other options don’t offer the same immediate, granular view. Installation monitoring is a vague term without a specific, built-in tool to reveal actions in real time. Log analysis looks at events after they’ve been recorded, which may miss stealthy installs that don’t leave obvious traces or that occur before logs are generated. Splunk is a powerful log-collection and search platform, but it relies on having logs to ingest; it isn’t a direct, real-time detector of hidden install activity by itself.