In this simulation, you will analyze a scenario involving dormant malicious code and internal threats. Learn to distinguish between different types of malware behavior and their specific triggers within an enterprise network.

CND (312-38) Network Defense Simulation

Network Scenario

You are monitoring the internal HR management server of a medium-sized enterprise. A disgruntled developer was recently terminated. Forensic analysis of the server's scheduled tasks and local scripts reveals a dormant snippet of code designed to execute a `rm -rf /database` command if the developer's employee ID is marked as "Inactive" in the payroll database.

Traffic & Logs

[SYSTEM] 2023-10-27 14:00:01 - Scheduled Task "DB_Cleanup" modified by User: Dev_09
[LOG] Logic Trigger Check: SELECT status FROM employees WHERE id='Dev_09';
[LOG] If status == 'Inactive' THEN RUN cleanup.sh
[ALERT] Integrity mismatch detected in /usr/local/bin/system_audit.sh
[IDS] Non-standard system call from internal process (ID: 4412)

Note: This code does not propagate across the network; it resides locally waiting for a specific condition.

Question

Which of the following is also known as slag code?

Expert Analysis

1. Network Context

In this scenario, we are looking at an "Insider Threat." Unlike external attacks (like DDoS), the threat is already inside the perimeter. The logs show a modification to a legitimate system task that now includes a conditional check.

2. Attack Pattern Recognition

The code in the logs (`If status == 'Inactive' THEN RUN cleanup.sh`) is a classic logic trigger. It is not self-replicating and does not require an external command-and-control (C2) channel to function once placed. This is often referred to in older security literature and CND terminology as "slag code."

3. Why B is Correct

Logic bombs (slag code) are snippets of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. Common triggers include specific dates, the absence of a specific user, or a certain number of database entries.

4. Why others are wrong

Trojan: A malicious program disguised as legitimate software. While it can contain a logic bomb, "slag code" is not its synonym.
Worm: Self-replicating malware that spreads across network connections. Slag code is typically static and localized.
IRC Bot: A malware instance that connects to a command server for remote control. Logic bombs operate autonomously based on internal triggers.

Mini Lesson: Defensive Mindset

Detecting "Slag Code" requires **File Integrity Monitoring (FIM)** and **Code Review**. Since these attacks often use legitimate administrative tools (like PowerShell or Bash), signature-based antivirus often misses them.

Key Signature: Logic bombs typically trigger on **Specific Events** (Date/Time, User Account status, or absence of a specific file).

Defensive Control: Segregation of duties and strict change management processes are the best defenses against the insertion of slag code by privileged users.