350-201 Question 217
Select 4You are investigating a suspicious file in a sandbox environment and have identified unusual network traffic patterns, repeated attempts to contact a known malicious domain, and specific file manipulations on the host system. Based on these observations, which Indicators of Compromise (IOCs) would you generate to further analyze and block this threat?
- A
Domain name of the malicious server contacted by the file
- B
Hash value of the suspicious file
- C
IP address of the sandbox environment
- D
Registry changes observed during file execution
- E
File path used by the suspicious file for temporary storage
Show answer and explanation
Correct answers: A, B, D, E
Explanation
When analyzing a file in a sandbox, it's essential to identify IOCs that provide actionable intelligence for detection or mitigation. This includes identifying external communications (e.g., domains), file hashes to track the malicious file, and system changes made by the file (e.g., registry changes or file paths). These IOCs help in creating detailed signatures and detection mechanisms while excluding irrelevant information like the sandbox's IP, which is not related to the malicious behavior.
- A. Correct.
The domain name of the malicious server is a critical IOC. It indicates external communication with a known threat actor and can be used to block or monitor similar traffic.
- B. Correct.
The hash value uniquely identifies the suspicious file and can help in identifying and stopping the spread of the same malicious file across systems.
- C. Incorrect.
The IP address of the sandbox environment is not a valid IOC as it does not relate to the malicious behavior observed; it is specific to the testing environment.
- D. Correct.
Registry changes made during execution provide insight into modifications that could indicate persistence mechanisms or malicious intent, making this an important IOC.
- E. Correct.
The file path used by the suspicious file for temporary storage can reveal details about its execution behavior and could help identify other compromised systems using the same pattern.