300-215 Question 80
Select 4During an incident response investigation, you are using Cisco Secure Network Analytics (formerly Stealthwatch) and Secure Endpoint. The SIEM logs indicate unusual outbound traffic from a host, and Secure Endpoint flags a suspicious executable on the same machine. Which Indicators of Compromise (IOCs) would you use to confirm the host has been compromised?
- A
The hash of the flagged executable matches a known malicious hash from threat intelligence databases.
- B
The outbound traffic includes connections to known Command-and-Control (C2) server IPs.
- C
The host's MAC address matches a known blacklisted device in the SIEM.
- D
The flagged executable is signed by a trusted certificate authority (CA).
- E
The flagged executable attempts to modify critical system files.
- F
The outbound traffic includes frequent DNS queries to randomly generated domain names.
Show answer and explanation
Correct answers: A, B, E, F
Explanation
To evaluate SIEM and malware analysis outputs effectively, you should focus on IOCs that strongly indicate malicious activity. Hash matches, connections to known C2 servers, critical system modifications, and behavior like frequent queries to random domains are key indicators of compromise. These IOCs collectively provide evidence that the host has been compromised and help guide your response actions.
- A. Correct.
Hash values are a strong IOC if they match known malicious hashes, as they indicate the executable is associated with known malware.
- B. Correct.
Outbound connections to known C2 servers are a clear sign of compromise as they suggest the host is communicating with attackers.
- C. Incorrect.
A host's MAC address being blacklisted is uncommon and not typically a reliable IOC for malware-related incidents.
- D. Incorrect.
Executables signed by a trusted CA are generally considered safe unless the certificate itself is compromised, which is not indicated here.
- E. Correct.
Attempts to modify critical system files are a strong IOC, as such behavior is characteristic of malware trying to establish persistence or disrupt the system.
- F. Correct.
Frequent DNS queries to randomly generated domains are indicative of Domain Generation Algorithm (DGA) activity, often used by malware for C2 communication.