Lesson 1.11: How malware gets in
Every infection has a way in. The common ones: e-mail attachments and links, fake downloads and updates, cracked software, removable media, exposed services with unpatched flaws, and compromised suppliers. Knowing the vector tells you what to fix so it doesn't happen again. In the lab you take yesterday's five detections and trace them back through the mail filter log, the web proxy log and a USB log, and find two risky attachments that were delivered but haven't caused alerts yet.
16 min
You will learn to
- Name the common initial access vectors
- Find risky attachment types in a mail log
- Find executable downloads in a proxy log
- Recognise infection through removable media
- Turn vectors into preventive controls
Key terms
- Initial access vector
- The route malware or an attacker uses to get in.
- Malicious attachment
- A file in an e-mail that runs or downloads malware when opened.
- Fake update / drive-by download
- A website that tricks visitors into downloading malware, often as a browser or plugin 'update'.
- Cracked software
- Paid software with its licence check removed, often bundled with malware.
- Removable media
- USB sticks, external drives, memory cards.
← Linux distributions · All lessons · Layered models: OSI and TCP/IP →