300-215 Question 84
Single answerDuring an incident investigation, you are analyzing the processes running on a compromised Windows server using Cisco Secure Endpoint. You observe a process named 'svchost.exe' running from the directory 'C:\Temp' with significant outbound network activity. What would be the most appropriate next step to validate whether this process is malicious?
- A
Verify the digital signature of 'svchost.exe' to confirm its authenticity.
- B
Terminate the process immediately to prevent further damage.
- C
Search for the hash of 'svchost.exe' in Cisco Secure Endpoint Threat Intelligence to check for known malicious indicators.
- D
Add the directory 'C:\Temp' to the trusted locations in Cisco Secure Endpoint to prevent false positives.
Show answer and explanation
Correct answer: C
Explanation
When analyzing processes, it is crucial to validate their behavior and authenticity before taking any disruptive action. Cisco Secure Endpoint Threat Intelligence provides real-time insights into known malicious indicators, making it an effective tool to confirm the nature of the suspicious process 'svchost.exe' running from an unusual directory.
- A. Incorrect.
Verifying the digital signature can help confirm authenticity, but it doesn’t provide immediate clarity on whether the process is malicious, especially if the signature is missing or spoofed.
- B. Incorrect.
Terminating the process immediately could disrupt the investigation. It is essential to collect evidence and validate its malicious nature before taking action.
- C. Correct.
Searching for the hash of 'svchost.exe' in Cisco Secure Endpoint Threat Intelligence provides a quick way to determine if the file is a known threat and helps validate its behavior.
- D. Incorrect.
Adding the directory to trusted locations is not a valid step in the analysis process and could increase the risk of false negatives.