Question

During an investigation, a SOC analyst reviews EDR telemetry from a compromised workstation. The analyst notes two distinct findings: (1) a specific SHA-256 hash matching a file quarantined on the host, and (2) a PowerShell process spawning from a Word document and immediately establishing an encoded outbound connection while attempting to disable logging. The analyst must classify these findings correctly to inform detection strategy. How should the analyst categorize the two findings?

Accepted Answer

Finding 1 is an Indicator of Compromise (IOC); Finding 2 is an Indicator of Attack (IOA)

Answer

Finding 1 is an Indicator of Attack (IOA); Finding 2 is an Indicator of Compromise (IOC)

Answer

Both findings are Indicators of Compromise (IOCs) because they were both observed on the endpoint

Answer

Both findings are Indicators of Attack (IOAs) because they both indicate malicious intent