3 points
Those all are things that require external human intervention though?
If the malware is persistent, then one way or another it needs to leave an exploit on the device, it can either be a persistance exploit, or a privesc exploit.
3 points
Right so the issue here is we are saying for the class of malware that is not persistent restarting the device will take it out of memory. Which is a strict positive
2 points
Yup. Although i’m not sure there are many (any?) malwares that don’t have some form of persistence. Exploits requiring human intervention are usually just the first stage, and persistance is the second.
I dont know of any APTs that are purely memory only, but if you know of one please link so I can read up on it.
