350-201 Question 219
Select 4You are analyzing a suspicious file in a sandbox environment to determine its Indicators of Compromise (IOCs). During the analysis, the file attempts to communicate with an external IP address, modifies several registry keys, and creates a new scheduled task. Which of the following are valid IOCs that can be generated from this activity?
- A
The external IP address the file attempted to contact
- B
The hash of the suspicious file
- C
The creation of the new scheduled task
- D
The CPU usage spike observed during the analysis
- E
The modified registry keys
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Indicators of Compromise (IOCs) are specific artifacts or evidence that indicate a potential breach or malicious behavior. In this scenario, artifacts such as the external IP address, the file hash, the creation of a scheduled task, and the modified registry keys are all specific and actionable IOCs that can be used to detect or respond to the threat. However, general system behavior like a CPU usage spike is not a valid IOC as it is not directly tied to the malicious activity in a reproducible way.
- A. Correct.
The external IP address the file attempted to contact is a valid IOC as it indicates potential communication with a malicious actor or Command and Control (C2) server.
- B. Correct.
The hash of the suspicious file is a valid IOC as it uniquely identifies the file and can be used to detect its presence in other systems.
- C. Correct.
The creation of the new scheduled task is a valid IOC as it indicates potentially malicious persistence mechanisms used by the file.
- D. Incorrect.
While a CPU usage spike may indicate suspicious activity, it is not a valid IOC on its own since it lacks specificity and reproducibility as a reliable indicator.
- E. Correct.
The modified registry keys are valid IOCs as they can indicate malicious changes made to the system by the suspicious file.