Question

An analyst detonates a suspicious executable in a sandbox. The output report shows the following observed behaviors: a child process spawned, a file written to %APPDATA%, and an outbound DNS query to 'update-svc.badhost[.]net' followed by an HTTPS connection to 175.120.44.9 on port 443. Based on this section of the report, which type of indicator is MOST directly identified by the DNS query and HTTPS connection?

Accepted Answer

A network-based indicator of compromise showing likely command-and-control communication

Answer

A host-based persistence mechanism established in the registry

Answer

A privilege escalation attempt using a stolen access token

Answer

A file integrity violation confirmed by a mismatched disk image hash