A SOC analyst compares two incidents from last week. Incident A shows an EDR alert for a new scheduled task running a PowerShell command from %APPDATA%. Incident B shows proxy logs with periodic HTTPS beaconing to a newly registered domain. Which finding provides the strongest evidence that both incidents belong to the same adversary campaign?

Linking incidents to one campaign requires evidence unique to that adversary, and attacker-controlled infrastructure is among the strongest. If the PowerShell command in Incident A's scheduled task reaches the same newly registered domain that Incident B is beaconing to, both hosts are talking to one command-and-control endpoint, which ties the persistence and the beaconing together. Identical ATT&CK technique IDs are weak evidence: scheduled tasks and web-protocol command and control are used by hundreds of groups and malware families, and in this scenario the two incidents actually show different techniques. Similar target systems and alerts within an hour suggest coincidence at best, since unrelated activity often overlaps in busy environments. A shared unpatched OS build describes a common weakness, not a common attacker, and scanners flag the same builds across the whole fleet. On the exam, favor specific shared artifacts such as domains, certificates or payload hashes over generic behavior classes when asked for the strongest link. Operationally, decode the scheduled task's command, extract its network indicators, search proxy and DNS logs for the domain across all hosts, and check registration data for related infrastructure.