3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is analyzing a suspicious executable in a sandbox. The sandbox report shows the executable creates a service named 'LegitService', sets it to auto-start, and then makes an HTTP request to a URL that includes a unique user-agent string. The analyst wants to create a detection rule for the organization's EDR. Which rule would be most effective?

   • AAlert when any process makes an HTTP request with the unique user-agent string
   • BAlert when a new service named 'LegitService' is created
   • CAlert when a service is set to auto-start on any endpoint
   • DAlert when a process creates a service and then makes an HTTP request with the unique user-agent string
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common IOC that can be extracted from a sandbox report?

   • AThe name of the analyst who submitted the file
   • BThe color of the malware's icon
   • CThe time zone of the sandbox server
   • DThe SHA-256 hash of the analyzed file
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A sandbox analysis of a downloaded file reveals that it contacts an IP address that is not in the organization's threat intelligence feed. The analyst checks the IP's reputation using a public service and finds it is associated with a known exploit kit. The file also creates a scheduled task named 'SystemCheck'. What should the analyst do to create a robust IOC set?

   • ADiscard the IP address because it is not in the internal feed
   • BUse the file hash, the IP address, and the scheduled task name as a combined indicator set
   • CUse only the IP address as an IOC because it is confirmed malicious
   • DUse only the scheduled task name because it is unique to this malware
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A sandbox report for a PDF file shows that it spawns a child process (cmd.exe) that executes 'whoami' and then makes an HTTP POST to a known malicious IP. Which combination of IOCs should be used to create a detection rule?

   • AThe 'whoami' command output
   • BOnly the destination IP address
   • CThe PDF file's creation date
   • DFile hash of the PDF, the parent-child process relationship, and the destination IP
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is analyzing a fileless attack that uses PowerShell to inject code into a legitimate process (notepad.exe). The sandbox report shows the PowerShell script downloads a payload from a URL and then injects it into notepad.exe. The team wants to create a detection rule that is effective but has low false positives. Which rule is best?

   • ADetect any process that injects code into notepad.exe.
   • BDetect any PowerShell process that makes a network connection.
   • CDetect when PowerShell downloads content and then injects code into another process.
   • DBlock all PowerShell script execution using AppLocker.
   Reveal Solution Discussion Select an answer first