At a manufacturer, an endpoint product scores a signed admin tool as suspicious because that tool's behavior is rare on the host, and no hash matched. What kind of detection produced the score?

Predictive or behavioral scoring that flagged the signed admin tool for rare behavior with no hash match produced the score. Predictive or behavioral scoring watches what a program does and raises the score when that behavior is rare on the host. The signed admin tool was flagged that way, and there was no hash match. This kind of detection does not require a known-bad file, and it can flag a legitimate admin tool whose behavior is unusual on that PC. A pure signature hit that matched a known-bad hash for that signed admin tool on the host would require a known-bad hash for the tool. The scenario says no hash matched, so a pure signature hit is not the detection that fired. Certificate expiry on the signing certificate for that admin tool, with no behavior score present in the alert would mean the signing certificate had expired and the alert was about that date. Certificate expiry is not described, and a date on a certificate does not score rare behavior. A VLAN access list on the plant switch that dropped the admin tool packets at the access port would drop the tool's packets at a switch port. It does not run on the endpoint as a behavior score, and the scenario describes a host product, not a switch drop. Exam caveat: a behavior score can flag an approved admin tool. Treat that score as a lead, not as a known-bad hash. Operational check: compare the signed tool with the software inventory or the change record before you isolate the host.