300-215 Question 78
Select 3You are a cybersecurity analyst investigating a potential breach on a host. Using Cisco Secure Network Analytics (formerly Stealthwatch) and a SIEM tool, you identify unusual outbound traffic to a suspicious IP address from a workstation. Upon further analysis, you also find that the workstation has a running process with an unsigned executable and a high number of failed outbound DNS queries. Which Indicators of Compromise (IOCs) should you prioritize for further investigation to confirm malicious activity?
- A
Suspicious outbound traffic to an unknown IP address
- B
Unsigned executable running on the workstation
- C
High number of failed outbound DNS queries
- D
Presence of a signed and legitimate software process on the host
- E
Normal outbound traffic to a trusted IP address
Show answer and explanation
Correct answers: A, B, C
Explanation
The correct answers are related to suspicious behaviors that deviate from normal activity and could indicate malicious activity. The outbound traffic to an unknown IP, the unsigned executable, and the failed DNS queries all align with typical behaviors of compromised hosts or malware. Conversely, legitimate processes and normal traffic do not indicate compromise and are not relevant IOCs in this scenario.
- A. Correct.
Suspicious outbound traffic to an unknown IP address is a strong IOC as attackers often use unknown or unusual IPs to exfiltrate data or establish command-and-control communication.
- B. Correct.
An unsigned executable running on the workstation is another IOC since malware often uses unsigned or tampered executables to evade detection.
- C. Correct.
A high number of failed outbound DNS queries can indicate an attempt by malware to resolve domain names for command-and-control servers, making it a significant IOC.
- D. Incorrect.
The presence of a signed and legitimate software process is not an IOC since it does not indicate malicious activity unless there is evidence of tampering.
- E. Incorrect.
Normal outbound traffic to a trusted IP address is expected behavior and does not qualify as an IOC.