Which Data Sources Survive Malware Cleanup to Reveal Root Cause?
Given a scenario, perform incident response activities
Given a scenario, use appropriate tools or techniques to determine malicious activity
An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on its infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host. Which of the following data sources would most likely reveal evidence of the root cause? (Choose two.)
Answer
Correct answer: B, E — Registry artifacts and file system metadata survive because the malware targeted the dropper, prefetch files, event logs, and host security services.
Community Insight
The exam tests process-of-elimination mapping: each cleanup action rules out a specific option—dropper deletion removes A, disabled host security services remove C, prefetch deletion removes D, and event log removal removes F.
This CySA+ CS0-003 scenario asks which forensic data sources remain useful after malware deletes its dropper, prefetch files, and event log entries. The correct choices are registry artifacts and file system metadata (B, E), because the described cleanup did not target those on-host sources.
Learners often pick EDR data or Sysmon logs because those can be centralized off-host, but the question explicitly says the malware disables host security services and removes event log entries, so the exam expects registry artifacts and file system metadata.
Community Discussion (19 comments)
rocco82
👍 1
Selected: BC
The question asks what datasources reveal evidence of the root-cause, that is after the cleanup routines of the malware. Let's asume that registry entries are also cleaned up. B. This includes Registry transaction logs C. EDR data is remotely stored.
RUE_BOT
👍 2
Selected: CF
Since the malware deletes local event logs, prefetch files, and the initial dropper, root-cause evidence must come from data sources that exist outside what the malware can locally erase: EDR captures telemetry sent to a centralized cloud/console (not stored solely on the compromised host), and Sysmon logs (if forwarded to a central SIEM/log collector) similarly survive local deletion attempts. Prefetch files (D) are explicitly stated as deleted by the malware. Creation time of dropper (A) is useless since the dropper itself was deleted. Registry artifacts (B) and file system metadata (E) could potentially be altered/cleaned by the same malware performing cleanup routines, making them less reliable than centrally-forwarded EDR/Sysmon data.
jim0thy
👍 3
Selected: CF
Both C and F data would be stored off-host. Even if the EDR was defeated by the malware, the initial stages leading to it should be visible in the EDR console and in the syslog server
cj207800
👍 2
Selected: BC
Registry artifacts can persist even after malware attempts to delete itself and clean up evidence. The Windows Registry often contains traces of persistence mechanisms, configuration changes, or remnants of malicious activity that are not easily erased by typical malware cleanup routines. EDR (Endpoint Detection and Response) data is specifically designed to capture detailed telemetry on endpoint activities, including process creation, file modifications, security service tampering, and suspicious behaviors. EDR solutions often collect and store this data centrally, making it available for investigation even if the attacker attempts to remove evidence from the compromised host
Justheretolook
👍 2
Selected: BC
The correct answers are: B. Registry artifacts C. EDR data Explanation: • B. Registry artifacts: Malware often modifies the Windows Registry to achieve persistence, disable security tools, or execute upon reboot. These artifacts can remain even if the malware attempts to clean up other traces. • C. EDR data (Endpoint Detection and Response): EDR tools typically record detailed telemetry about process execution, file creation, registry changes, and more—even if the malware tries to erase logs. EDR often maintains a tamper-resistant log of activity that can reveal the initial infection vector and actions taken by the malware.
fuzzyguzzy
👍 2
Selected: BE
B. Registry artifacts E. File system metadata I was stuck between E and F, but the question says event logs were deleted and file system metadata can be extracted from file recovery or inspecting timestamps of modified files.
cy_analyst
👍 2
Selected: BF
Sysmon logs provide detailed monitoring of system activity, including process creation, file modifications, and network activity. It operates independently from the normal Windows event logs, which the malware is likely trying to erase or manipulate. Even if the malware is trying to erase traditional event logs, Sysmon may still capture events like process execution (when the dropper first ran), file modifications, or network connections. Sysmon is typically harder for malware to disable or clean up fully, as it logs more granular details about system activity. Since the malware is tampering with logs, using an alternative logging source like Sysmon can provide more robust evidence of what happened.
cy_analyst
👍 1
I change the answer of F for B because of the facts in this context:While EDR data can technically be tampered with or deleted if the malware has sufficiently high privileges, its architecture often makes it more difficult to fully wipe out, especially if data is sent remotely or tamper-resistant mechanisms are in place. This is why EDR data can sometimes still provide useful artifacts, even in scenarios where the attacker has high-level access.
kinny4000
👍 1
Selected: BF
Everything has been tampered with other than the registry, file system metadata and sysmon entries. So obviously the registry should be checked, it's between sysmon and metadata. Sysmon will store more info than metadata so sysmon is the clear winner. (Sysmon is a separate logging system than windows event logs, if setup properly they can contain more data than windows event logs.
SH_
👍 1
Selected: BE
BE during forensic analysis
Kmelaun
👍 24
Selected: BE
The question says that the Malware would disables any host security services (which is C. EDR) and performs clean-up routines on it's affected host in eluding deletion of initial dropper (A.Creation time of dropper) and removal of event log entries (F.Sysmon event log) and prefetch files from the host (D.Prefetch files). So wouldn't the only left be B.Registry artifacts and E. File System metadata?
kinny4000
👍 1
Sysmon event logs are a separate service to windows event logs, they weren't deleted.
section8santa
👍 3
Selected: CF
C. EDR data: Endpoint Detection and Response (EDR) tools are designed to continuously monitor endpoint and network events and store this information in a centralized database. EDR data can provide detailed information about the processes that have been executed on the infected hosts, network connections that were established, and possibly the actions taken by the malware before event logs and prefetch files were deleted. F. Sysmon event log: System Monitor (Sysmon) is a Windows system service and device driver that remain resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time, which malware often modifies. Sysmon logs can be very comprehensive and, if configured properly before an incident, could provide information that regular event logs do not capture, especially since malware often targets and deletes standard Windows event logs to cover its tracks.
RottenBarracuda
👍 2
Selected: BF
EDR wont work if the malware disabling it.
Bogus1488
👍 4
Selected: BE
B and E?
Franky30
👍 4
Selected: CE
B. Registry artifacts: Malware often leaves traces in the Windows Registry, and analyzing registry entries can provide insights into the activities of the malware, including changes made to the system settings. E. File system metadata: File system metadata, such as file creation times, modification times, and access times, can reveal information about the malware's actions, including the creation time of the initial dropper and other files manipulated during cleanup routines.
Tdarling77
👍 1
C, E. Here are the two data sources most likely to reveal evidence of the root cause of the malware outbreak, considering the malware's cleanup routines: C. EDR data: Endpoint Detection and Response (EDR) solutions offer extensive visibility into endpoint activity. Even though the malware attempts to remove evidence by deleting prefetch files and event logs, EDR solutions might have already captured these details before they were erased. EDR can provide valuable information about the initial infection vector, suspicious processes, and network connections that could lead to the root cause. E. File system metadata: File system metadata includes information about files beyond their content, such as creation time, modification time, and access time. While the malware deletes the dropper file itself, the file system metadata associated with the deleted dropper file might still be present. This metadata, particularly the creation time (A.), could be crucial in pinpointing when the initial infection occurred and potentially identifying the entry point.
Jhonattan0032
👍 2
Selected: BF
Registry artifacts and Sysmon event log
jspecht
👍 2
It says the malware removed event log entries so it's unclear exactly which ones. If Sysmon was not cleared, it would be very helpful in determining the root cause.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The scenario is built as an elimination exercise: every cleanup action named in the stem maps to one of the wrong options. The malware deletes the initial dropper, so the dropper's creation time (A) is no longer a reliable source; it also removes prefetch files (D) and event log entries (F), and disables host security services, which is how the exam represents EDR (C). That leaves registry artifacts (B) and file system metadata (E) as on-host sources the described cleanup did not explicitly target. Registry hives can retain service configuration changes, persistence keys, and defense-disabling settings, while file system metadata such as timestamps and MFT records can show file creation, modification, and deletion activity even after the visible file is gone. As Kmelaun reasoned, once the dropper, event logs, prefetch, and host security services are eliminated, "the only left" sources are registry artifacts and file system metadata.Why the Other Options Are Wrong
A is tempting because the dropper's creation time would help establish the timeline, but the stem says the dropper itself was deleted; without recovery or prior collection, that timestamp is not the most likely source. C fails under the question's own premise that host security services were disabled, even though real-world EDR consoles often retain off-host telemetry—a nuance jim0thy and RUE_BOT raised. D is directly excluded because prefetch files were removed. F is also excluded because event log entries were removed; Sysmon is valuable when forwarded to a SIEM, but the question does not say that and instead describes local event-log cleanup. The exam rewards matching each stated cleanup action to the option it defeats.Community Comment Notes
Comments split between the elimination answer (B, E) and off-host telemetry answers (C, F). Kmelaun's popular explanation maps the malware's cleanup actions to A, C, D, and F, leaving B and E; Bogus1488 and fuzzyguzzy reached the same B/E conclusion. jim0thy and RUE_BOT argued that EDR and Sysmon data are stored off-host and should survive local deletion, which is a valid real-world point but conflicts with the question's explicit "disables host security services" and "removal of event log entries" wording. Franky30 highlighted registry changes and file timestamps, while cy_analyst focused on Sysmon's independent logging; these comments show why the stem's exact wording, not general product capability, determines the exam answer.Official Reference
Exam Strategy
When a question lists cleanup actions, map each action to an option and eliminate it; the unmentioned on-host sources are usually the intended answer. For multi-select root-cause questions, be careful not to substitute general product capability for what the scenario says actually happened.
Frequently Asked Questions
Why isn't EDR data (C) the answer if telemetry is stored off-host?
The question says the malware disables host security services, so the exam treats EDR as unavailable; the cleanup left registry and file system metadata as the intended surviving sources.
Why are prefetch files and Sysmon logs not reliable here?
The scenario explicitly says the malware removes prefetch files and event log entries, which eliminates D and F before analysis.