After an incident at a retailer, responders publish a file hash and a callback domain found on a payment server. What term names those two artifacts?
Select an answer to reveal the explanation.
Short Explanation
A fingerprint card filed after a burglary is not the same as watching the burglar climb through the window. You name a published hash and callback domain as indicators of compromise. The trap is a live behavior, the asset owner, or the evidence sign-out log.
Full Explanation
Indicators of compromise are residue of an intrusion: a file hash, a domain, an address, or a similar artifact that investigators can search for after the activity. Publishing the hash and the callback domain from the payment server names what was left behind, not who owns the server and not the log of who carried the disk. "Indicators of compromise: the published hash and callback domain left by the intrusion". Both published values are artifacts of the intrusion, which is what that term records. "Indicators of attack: live behaviors to watch while the intrusion is still underway on the host". That term is for behavior while the intrusion is underway, such as a process starting another process. A hash and a domain published after the incident are residue, not the live action. "The asset owner listed for the payment server on the retailer inventory after the incident". The owner is an accountability entry on an inventory. Ownership does not describe the hash or the domain the responders published. "The chain of custody for who held the disk image and when they received and released it". That record tracks who received evidence and when they let it go. It is not the indicator the team published from the server. Exam caveat: the same hash can later be reused in a hunt. A static artifact is a compromise indicator; a behavior in progress is an attack indicator. Operational check: search retailer endpoints for the published hash and callback domain and confirm the case stores them as artifacts.