At a manufacturer, a design file's hash matches a published indicator, and a process on the file server is spawning a script host right now. Which fact is the indicator of attack?
Select an answer to reveal the explanation.
Short Explanation
A wanted poster is a clue about a file, while watching someone force a window right now is the act itself. You take the live spawning of a script host as the indicator of attack. The trap is the hash match, the asset tag, or the custody form.
Full Explanation
An indicator of attack is behavior observed as it happens. A process on the file server spawning a script host right now is that behavior. The hash match is a static compromise indicator for the design file. The asset tag names hardware. The custody form records who checked out an image. "The live process behavior of a file-server process spawning a script host at this moment". The spawning of the script host is happening now, so that live behavior is the attack indicator. "The hash match between the design file and the published indicator of compromise". A hash match against a published indicator is a compromise indicator for the file. It can be true in the same case and still is not the live behavior. "The file server asset tag in the plant inventory, naming the hardware and its owner". An asset tag identifies the server and its owner in inventory. Hardware identity is not a process spawning a script host. "The custody form signed when the design-file image was checked out of storage". A custody form records the checkout of an image. Handling paperwork is not the process behavior on the server. Exam caveat: one case can contain both a compromise indicator and an attack indicator. The question asks which fact is the behavior in progress. Operational check: capture the process tree showing the file-server process creating the script host, with a current time, stored separately from the hash match on the design file.