An agency threat feed publishes a known-bad hash for a loader already seen in the sector. Which detection should the SOC write first for that hash?
Select an answer to reveal the explanation.
Short Explanation
When a wanted poster already shows a clear photo, you post that photo before you study the crowd. You write a signature or rule for the published loader hash. The trap is skipping that hash for a volume baseline, a risk write-up, or a new access model.
Full Explanation
A published hash is a known pattern. The direct detection is a signature or matching rule that alerts when that digest appears. A baseline that ignores the hash, a written risk score, and a new access model do not match the file the feed named. "A signature or other matching rule written for that published loader hash" is the detection to write first. "A statistical baseline that sets the known hash aside and watches volume only" throws away the indicator the feed already gave you. "A risk assessment that scores the loader and never matches the published hash" may rank the threat and still will not detect the file. "A new access-control model that replaces the detection content for the loader" changes who may access systems and does not look for the digest. Exam caveat: a hash rule matches that digest only, so a rebuilt loader with a different hash will not hit it. Operational check: search current telemetry for the published hash and confirm the new rule alerts on a copy of that file. Do that search before you rely on a volume baseline alone.