300-215 Question 77
Select 4You are investigating a potential malware infection on a host within your network. Using Cisco SecureX to analyze data collected from your SIEM and malware analysis tools, you observe the following outputs:
- A high volume of outbound traffic to an unknown IP address.
- A process named 'svch0st.exe' running on the host, which does not match legitimate Windows processes.
- A file hash flagged as malicious by Cisco Threat Grid.
- Persistence mechanisms involving registry modifications.
Which Indicators of Compromise (IOCs) should you prioritize for further investigation?
- A
High volume of outbound traffic to an unknown IP address
- B
The process named 'svch0st.exe' running on the host
- C
A file hash flagged as malicious by Cisco Threat Grid
- D
Presence of legitimate Windows processes such as 'svchost.exe'
- E
Registry modifications creating persistence mechanisms
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Indicators of Compromise (IOCs) such as unusual outbound traffic, suspicious processes, malicious file hashes, and registry persistence mechanisms are critical for identifying and analyzing potential malware infections. Legitimate system processes like 'svchost.exe' should not be prioritized unless there is evidence of compromise. Focusing on the listed IOCs allows you to isolate and mitigate threats effectively using tools like Cisco SecureX.
- A. Correct.
High outbound traffic to an unknown IP address could indicate command-and-control (C2) communication, which is a common IOC for malware.
- B. Correct.
The process 'svch0st.exe' is suspicious as it mimics a legitimate Windows process ('svchost.exe') but includes a typographical anomaly, often used by malware to evade detection.
- C. Correct.
A file hash flagged as malicious by Cisco Threat Grid is a direct indicator of malicious activity and should be investigated thoroughly.
- D. Incorrect.
Legitimate Windows processes, such as 'svchost.exe', do not inherently indicate malicious activity and are not considered an IOC unless manipulated.
- E. Correct.
Registry modifications creating persistence mechanisms are often used by malware to maintain access to an infected system, making them a critical IOC to investigate.