350-201 Question 220
Select 4You are tasked with analyzing a suspicious file in a Cisco Threat Grid sandbox environment. During the analysis, you observe the following behaviors: the file attempts to connect to an external IP address, modifies the Windows Registry to run at startup, and drops an additional executable file in the %TEMP% directory. Which of the following are valid Indicators of Compromise (IOCs) that can be generated from this analysis?
- A
The external IP address the file attempted to connect to
- B
The hash value of the suspicious file
- C
The modification to the Windows Registry for persistence
- D
The name of the sandbox environment used
- E
The dropped executable file path in the %TEMP% directory
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Indicators of Compromise (IOCs) are artifacts observed in a sandbox environment that indicate potential malicious activity. These include external IP addresses for communication, file hashes for identification, registry modifications for persistence, and file paths for dropped executables. The sandbox environment name is not an IOC as it does not provide evidence of malicious behavior.
- A. Correct.
The external IP address is a key IOC as it indicates potential communication with a command-and-control server.
- B. Correct.
The hash value of the suspicious file is a critical IOC for identifying the file across systems and databases.
- C. Correct.
The modification to the Windows Registry for persistence is an IOC since it shows an attempt to maintain unauthorized access.
- D. Incorrect.
The name of the sandbox environment is not an IOC. It is part of the analysis context and does not indicate malicious behavior.
- E. Correct.
The dropped executable file path in the %TEMP% directory is an IOC as it provides evidence of the file's activity and possible malicious intent.