Cisco Secure Endpoint flags several indications of compromise on a laptop: a document opened from email spawned a scripting engine, a new persistence entry appeared and an unusual outbound connection followed. No file on the laptop was convicted. How should this be interpreted?
Select an answer to reveal the explanation.
Short Explanation
Think of it as three witnesses telling the same story: a document launched a script, something dug in to survive reboots, then the box called out. None of them is a smoking gun alone, but together you've got a case. Don't wait for a file conviction before you go look.
Full Explanation
Cisco Secure Endpoint evaluates sequences of activity against indications of compromise, behavioral patterns that suggest an intrusion even when no individual file has a malicious disposition. A document spawning a scripting engine, the creation of a persistence mechanism and an unusual outbound connection together match a common attack chain: initial access, establishing persistence and command-and-control. Their correlation on one host is the signal, and it calls for investigation of that laptop with device trajectory, followed by containment if the activity is confirmed. Compromise is not reported only through file convictions; attackers frequently use legitimate tools and scripts that never produce a malicious file disposition, which is why behavioral IOCs exist. These are separate observations of different behaviors, not duplicates of one event, and excluding them would hide a possible intrusion. IOC events are not a post-quarantine message and do not indicate remediation; nothing has been cleaned up at this stage. Exam caveat: individual IOCs can fire on unusual but legitimate administration, so judge the combination and the context before escalating. Operational check: open device trajectory for the laptop, trace the scripting engine back to the email attachment, identify the persistence entry and the remote address, and isolate the host if the chain is confirmed.