According to the CHFI v11 objectives under Malware Forensics and Linux Memory and System Behavior Analysis , monitoring system calls is a core technique for understanding how malware interacts with the operating system at a low level. On Linux systems, strace is the primary and most effective tool for this purpose.
strace intercepts and records system calls made by a process, along with the signals received and return values. Since all interactions between user-space programs and the Linux kernel occur via system calls, tracing them provides deep visibility into malware behavior. Using strace, investigators can observe actions such as file creation or modification (open, write), privilege escalation attempts (setuid), network communications (connect, sendto), process creation (fork, execve), and access to protected system resources.
This makes strace indispensable for dynamic malware analysis on Linux , as emphasized in CHFI v11.
The other options are incorrect. Process Explorer and Autoruns are Windows-based tools and do not operate on Linux systems. Regshot is also Windows-specific and is used to compare registry snapshots, which are irrelevant in Linux environments.
The CHFI Exam Blueprint v4 explicitly includes Linux malware behavior analysis and monitoring system- level activity , making strace the correct, forensically sound, and exam-aligned tool for tracking malware system calls