3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A sandbox report for a trojan shows that it modifies the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' to add a value named 'Updater', and then communicates with the domain 'update-check.example.com'. The analyst wants to create a complex indicator that detects this trojan on other hosts. Which indicator would be most effective?

   • AAlert when the registry key 'Run' is modified by any process
   • BAlert when the registry value 'Updater' is created under the Run key
   • CAlert when a process creates the 'Updater' registry value AND subsequently resolves 'update-check.example.com'
   • DAlert when any process resolves 'update-check.example.com'
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is analyzing a banking trojan that uses a legitimate code-signing certificate to sign its executable. The sandbox report shows the trojan modifies the browser's proxy settings and injects code into the browser process. The team wants to create a detection rule that is effective but has low false positives. Which rule is best?

   • ABlock all executables signed with that certificate.
   • BDetect when a signed executable modifies browser proxy settings and injects code into a browser process.
   • CDetect any process that modifies browser proxy settings.
   • DDetect any process that injects code into a browser process.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A sandbox report for a ransomware sample shows that it encrypts files with a specific extension and leaves a ransom note. The report also shows the ransomware creates a mutex and connects to an IP address. Which IOC is most likely to be unique to this ransomware family?

   • AThe IP address of the C2 server
   • BThe content of the ransom note
   • CThe mutex name
   • DThe file extension used for encrypted files
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A sandbox report shows a sample that creates a file named 'update.exe' in the Temp folder, modifies the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key, and then connects to a domain that is categorized as 'newly seen' by the threat intelligence feed. The analyst must decide which IOCs to prioritize for immediate action. What is the best decision?

   • APrioritize the registry key modification and the domain
   • BPrioritize the registry key modification only
   • CPrioritize the file hash of 'update.exe' and the domain, after correlating with threat intelligence
   • DPrioritize the file name 'update.exe' and the Temp folder path
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A sandbox report shows a binary attempting to connect to an IP address that is not on any threat intelligence blocklist. The binary also drops a file named 'update.dll' and creates a service named 'Windows Update Service'. What should the analyst do to validate the IP as an IOC?

   • AImmediately block the IP in the firewall because the binary attempted to connect to it.
   • BCorrelate the IP with the dropped file hash and service name to see if they appear together in other sandbox reports or threat intelligence feeds.
   • CIgnore the IP because it is not on any blocklist.
   • DUse the IP as a standalone IOC because the binary attempted to connect to it.
   Reveal Solution Discussion Select an answer first