At a bank, an analyst watches a help-desk tool spawn a shell and connect to a rare address while that activity is still underway, and no file hash has been published. What term fits this observation?

An indicator of attack is adversary behavior observed as it happens: a trusted tool starting a shell, then that shell contacting an unusual destination. No published hash is required, because the evidence is the behavior itself. A later hash, a handling log, and a rated exposure answer different questions. "An indicator of attack: the live behavior of a help-desk tool spawning a shell toward a rare address". The observation is the live process behavior and the rare connection, which is an attack indicator. "An indicator of compromise in the form of a static file hash published after the activity". A compromise indicator of this kind is a static hash published from a file. The stem states that no hash has been published, so that artifact is not what the analyst is watching. "A chain-of-custody entry for who received the bank workstation and when it was released". A custody entry records who held a workstation and when they released it. It does not describe a process spawning a shell. "A risk assessment that rates the help-desk tool on the bank's current exposure register". A risk assessment rates exposure. Watching a live process tree is not the act of scoring the tool on a register. Exam caveat: this same activity can later yield a hash or a domain that you would store as a compromise indicator. At the moment described, the observation is the behavior. Operational check: record the process tree from the help-desk tool to the shell and the rare destination while the activity is still in progress.