Your organization uses Zeek for NSM. An analyst notices that the files.log shows a PE executable (application/x-dosexec) was downloaded over HTTP from an internal file server to 30 workstations within 5 minutes. What is the most important immediate action?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because rapid distribution of an executable to 30 hosts in 5 minutes is an unusual pattern warranting immediate triage: hash + sandbox analysis confirms maliciousness, and isolating workstations contains potential spread while investigation proceeds. A is wrong because legitimate software deployments use managed distribution channels (SCCM, Ansible, etc.) and would not exhibit this ad-hoc pattern.
Full explanation below image
Full Explanation
B is correct because rapid distribution of an executable to 30 hosts in 5 minutes is an unusual pattern warranting immediate triage: hash + sandbox analysis confirms maliciousness, and isolating workstations contains potential spread while investigation proceeds. A is wrong because legitimate software deployments use managed distribution channels (SCCM, Ansible, etc.) and would not exhibit this ad-hoc pattern. C is wrong because blocking the file server's perimeter IP does not address hosts already infected and may disrupt legitimate services. D is wrong because reimaging before forensic analysis destroys evidence and may be unnecessary if analysis shows a false positive.