A hotel has no file hash for a new tool. The front-desk PC starts a process that has never run there and opens a rare outbound port. Which detection fits this lead?
Select an answer to reveal the explanation.
Short Explanation
A stranger using a hallway that has never seen that stride stands out even with no mugshot. You compare the new process and rare port with the front-desk baseline. The trap is a signature for a hash you do not have, a vulnerability score, or an asset tag.
Full Explanation
There is no known hash, so a signature built on a digest cannot be written yet. What the hotel does have is a departure from the host baseline: a process that has never run on the front-desk PC and a rare outbound port. That is a behavioral or statistical lead. "Behavioral or statistical detection against the normal baseline of the front-desk PC" fits. "A signature written for a file hash that this hotel does not have for the new tool" asks for an indicator that does not exist. "A CVSS score for the unknown tool when no published weakness is available to rate" is a severity label, not a detector, and there is no scored weakness in the stem. "An asset tag that names the front-desk PC without describing the new process or port" identifies the machine and skips the new behavior. Exam caveat: a baseline hit can flag a legitimate new admin tool, so the alert is a lead and not proof of malware. Operational check: compare the process name and the outbound port with front-desk history and confirm both are absent from the normal baseline. Save that comparison in the case notes.