Overview
Domain 3 covers the core of compromising a host. Vulnerability analysis covers identifying and classifying weaknesses, using scoring systems such as CVSS, vulnerability scanners and vulnerability management. System hacking covers the methodology of cracking passwords, escalating privileges, executing applications, hiding files and covering tracks, including techniques such as pass-the-hash, keylogging, steganography and clearing logs. Malware threats covers the types of malware (trojans, viruses, worms, rootkits, ransomware, fileless malware), how they are delivered and concealed, and how they are analyzed and countered.
These three modules map onto the gaining-access, maintaining-access and clearing-tracks phases. The reconnaissance from Domain 2 feeds this domain, and the techniques here appear again in the network, web and other attack domains. The exam tests both the methodology order and the specific techniques and their countermeasures.
How it's tested
Expect questions on the system hacking methodology order, on identifying a technique or malware type from its behavior, and on choosing the correct countermeasure. Vulnerability analysis questions test scoring and scanner interpretation. Read the full scenario and every option carefully before deciding.
-
Methodology order
A system hacking scenario is at a given step, and you must choose what comes next in the methodology.
-
Identify the technique or malware
A behavior is described, and you must name the attack technique or malware type.
-
Right countermeasure
An attack is described, and you must choose the defense that counters it.
An attacker has captured NTLM password hashes from a compromised host but cannot crack them in time. Cracking is the obvious next step, but it may be slow or fail. Many Windows environments accept authentication with the hash itself, so a pass-the-hash attack lets the attacker authenticate to other systems without recovering the plaintext password, which is the technique the exam expects here.
Domains 3
Official domains from the EC-Council outline, in outline order.
3.1 Vulnerability AnalysisIdentifying, classifying and scoring vulnerabilities with scanners and CVSS.
- What it means
- Vulnerability analysis covers the vulnerability management life cycle, classifying vulnerabilities, scoring them with systems such as CVSS, using vulnerability scanners and assessment tools, and interpreting their output, including distinguishing true findings from false positives.
- What to understand
- A scanner finding is a lead to validate, not a confirmed exploit. CVSS rates technical severity but not your specific risk. Authenticated scans find more than unauthenticated ones. Vulnerability analysis bridges reconnaissance and exploitation by deciding what is worth attacking.
- How it shows up
- A scan result or scoring question is posed, and you must interpret it or choose the next step such as validation.
- Common confusion
- Treating a scanner finding as a confirmed vulnerability. It must be validated before exploitation.
3.2 System HackingPassword cracking, privilege escalation, execution, hiding files and covering tracks.
- What it means
- System hacking follows a methodology: gaining access through password attacks (dictionary, brute force, rainbow tables, pass-the-hash), escalating privileges, executing applications (keyloggers, spyware, remote execution), hiding files and data (steganography, alternate data streams, rootkits), and covering tracks by clearing logs and disabling auditing.
- What to understand
- The methodology has an order: you escalate privileges before running tools that need them, and cover tracks last. Pass-the-hash reuses captured hashes without cracking. Rootkits hide at a deep level and may require offline detection. Clearing logs is a covering-tracks technique the exam expects you to recognize.
- How it shows up
- A methodology step or a specific technique is described, and you must choose the next step, the technique or its countermeasure.
- Common confusion
- Confusing privilege escalation with execution. Escalation raises privileges; execution runs code, often needing those privileges first.
3.3 Malware ThreatsTrojans, viruses, worms, rootkits, ransomware and fileless malware, plus analysis and countermeasures.
- What it means
- Malware threats covers the types of malware (trojans, viruses, worms, rootkits, ransomware, backdoors, fileless malware), how they propagate and hide, advanced persistent threats, malware analysis through static and dynamic methods and sandboxing, and countermeasures such as anti-malware, allowlisting and behavior analysis.
- What to understand
- The types behave differently: a virus needs a host file and user action, a worm self-propagates, a trojan disguises itself, and fileless malware runs in memory using legitimate tools. Static analysis examines code without running it; dynamic analysis runs it in a sandbox. Fileless malware evades signature tools, so behavior-based defenses matter.
- How it shows up
- A malware behavior is described, and you must identify the type or choose the analysis method or countermeasure.
- Common confusion
- Confusing viruses and worms. A worm spreads by itself across networks; a virus needs a host file and execution.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
System hacking methodology
Gain access, escalate privileges, execute applications, hide files, cover tracks.
- Remember
- The order matters; escalation precedes execution that needs privileges.
- Tested as
- Methodology-order questions.
- Trap
- Running privileged tools before escalating.
-
Pass-the-hash
Authenticating with a captured hash without cracking it.
- Remember
- Common in Windows environments and faster than cracking.
- Tested as
- Password attack questions.
- Trap
- Assuming the plaintext must be recovered first.
-
Rainbow tables
Precomputed hash tables used to reverse unsalted hashes.
- Remember
- Salting defeats them.
- Tested as
- Password cracking questions.
- Trap
- Expecting them to work against salted hashes.
-
Privilege escalation
Gaining higher privileges than initially obtained.
- Remember
- Vertical raises privilege level; horizontal moves to another account at the same level.
- Tested as
- Methodology questions.
- Trap
- Confusing it with lateral movement or execution.
-
Rootkit
Malware that hides itself at a deep system level with high privilege.
- Remember
- May need offline detection or rebuilding.
- Tested as
- Hiding and malware questions.
- Trap
- Trusting the infected OS to detect it.
-
Steganography
Hiding data inside another file such as an image.
- Remember
- It conceals the existence of data, not just its content.
- Tested as
- Hiding-files questions.
- Trap
- Confusing it with encryption.
-
Alternate data streams
Hidden NTFS streams used to conceal data on Windows.
- Remember
- Easy to miss without specific tools.
- Tested as
- Hiding-files questions.
- Trap
- Overlooking them on Windows file systems.
-
Covering tracks
Clearing logs and disabling auditing to hide activity.
- Remember
- It is the final phase of the methodology.
- Tested as
- Methodology questions.
- Trap
- Doing it before completing other steps.
-
Virus vs. worm vs. trojan
A virus needs a host and user action, a worm self-propagates, a trojan disguises itself.
- Remember
- Worms spread without user action.
- Tested as
- Malware classification questions.
- Trap
- Calling a self-spreading threat a virus.
-
Fileless malware
Malware that runs in memory using legitimate tools without writing files.
- Remember
- It evades signature-based detection.
- Tested as
- Malware and defense questions.
- Trap
- Relying on file-based antivirus against it.
-
CVSS
A system for scoring vulnerability severity from 0 to 10.
- Remember
- Severity is not the same as your risk.
- Tested as
- Vulnerability analysis questions.
- Trap
- Prioritizing by base score alone.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Virus vs. worm vs. trojan vs. fileless malware
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Virus | Attaches to a host file and needs execution | Requires user action | Confusing it with a worm |
| Worm | Self-propagates across networks | Spreads without user action | Calling it a virus |
| Trojan | Disguises itself as legitimate software | Relies on deception | Expecting it to self-replicate |
| Fileless malware | Runs in memory using legitimate tools | Leaves few files to scan | Relying on signatures to catch it |
Vertical vs. horizontal privilege escalation
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Vertical | Gaining higher privilege, such as admin or root | Raises the privilege level | Confusing it with lateral movement |
| Horizontal | Accessing another account at the same level | Same privilege, different account | Treating it as escalation of level |
Static vs. dynamic malware analysis
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Static analysis | Examining code without running it | Safe, no execution | Expecting runtime behavior |
| Dynamic analysis | Running malware in a sandbox | Reveals behavior | Trusting a quiet result from sandbox-aware malware |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Crack before reusing
- What candidates pick
- Spend time cracking captured hashes before using them.
- Why it looks right
- Cracking recovers the real password.
- Why it's wrong
- Pass-the-hash can authenticate with the hash directly in many Windows environments, which is faster and quieter.
Clue to watch for Captured hashes and a time or stealth constraint are mentioned.
-
Escalate after executing
- What candidates pick
- Run a tool that needs admin rights before escalating privileges.
- Why it looks right
- Running the tool seems like progress.
- Why it's wrong
- The methodology escalates privileges first so privileged tools can run.
Clue to watch for The action requires higher privileges than currently held.
-
Worm called virus
- What candidates pick
- Label a self-spreading network threat a virus.
- Why it looks right
- Both are malware.
- Why it's wrong
- A worm propagates by itself; a virus needs a host file and user action.
Clue to watch for The malware spreads without any user interaction.
-
Antivirus for fileless
- What candidates pick
- Rely on signature antivirus to stop in-memory malware.
- Why it looks right
- Antivirus is the familiar defense.
- Why it's wrong
- Fileless malware leaves little to scan, so behavior analysis and EDR are needed.
Clue to watch for The malware runs in memory using legitimate tools.
-
Scan result is confirmed
- What candidates pick
- Exploit a scanner finding without validating it.
- Why it looks right
- The scanner reported it.
- Why it's wrong
- Scanners produce false positives; validate against the real version and configuration first.
Clue to watch for The finding may not match the installed version.
-
Trust the infected OS
- What candidates pick
- Run a scan on the live system to confirm a suspected rootkit is gone.
- Why it looks right
- Scanning is the normal detection method.
- Why it's wrong
- A rootkit can hide from the infected OS, so offline scanning or rebuilding is safer.
Clue to watch for A rootkit or deep compromise is suspected.
Answer framework
For any Domain 3 system hacking scenario, use these steps before choosing an answer.
- Place the activity in the system hacking methodology, from gaining access through privilege escalation and execution to hiding files and finally covering tracks.
- Respect the order, escalating privileges before running tools that need them and covering tracks only at the end.
- For credentials, prefer reuse such as pass-the-hash over slow cracking when the environment allows it.
- Classify any malware by its behavior, distinguishing viruses, worms, trojans, rootkits and fileless malware, and then choose the matching defensive countermeasure.
- Treat scanner findings as leads to validate, and match each attack to its specific countermeasure, and confirm each finding before acting on it.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Learn the system hacking methodology as an ordered sequence first, because many questions test what comes next. Internalize that you escalate privileges before running privileged tools and cover tracks last.
Next, study the specific techniques within each step and their countermeasures: password attacks including pass-the-hash and rainbow tables, privilege escalation types, hiding techniques such as steganography and alternate data streams, and log clearing. The exam pairs each technique with a defense, so learn them together.
Then give malware threats focused attention. Build a table of malware types by behavior and defense, and be clear on the virus-versus-worm distinction and why fileless malware evades signatures. Add static versus dynamic analysis.
Vulnerability analysis is the smallest of the three modules; learn CVSS basics and the habit of validating findings. A lab with a safe target for password attacks and a sandbox for malware analysis helps. Afterwards, move to Domain 4, the largest domain, which reuses many of these techniques at the network level.
FAQ
How much of CEH v13 is Domain 3?
System Hacking Phases and Attack Techniques is about 15% of the exam, roughly 19 questions across vulnerability analysis, system hacking and malware threats.
What is pass-the-hash?
Authenticating to a system using a captured password hash directly, without cracking it to recover the plaintext. It is common in Windows environments.
What is the difference between a virus and a worm?
A virus attaches to a host file and needs user action to spread. A worm self-propagates across networks without user action.
Why does privilege escalation come before execution?
Because many tools and actions require elevated privileges. The methodology escalates first so that privileged execution can succeed.
How is fileless malware detected?
Through behavior analysis and endpoint detection and response, since it runs in memory using legitimate tools and leaves little for signature-based antivirus to find.
Does a high CVSS score mean high risk?
CVSS rates technical severity, not your specific risk. Exposure, asset value and existing controls also matter, so validate and contextualize findings.
How does Domain 3 connect to the rest of the exam?
Its techniques map onto the gaining-access, maintaining-access and clearing-tracks phases and reappear in the network, web and other attack domains.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 3 knowledge
You have covered vulnerability analysis, the system hacking methodology and malware threats. Test whether you can order the methodology and classify techniques under exam conditions.