Your organization uses Zeek for NSM. An analyst notices that the files.log shows a PE executable (application/x-dosexec) was downloaded over HTTP from an internal file server to 30 workstations within 5 minutes. What is the most important immediate action?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when a portable executable hits 30 workstations in 5 minutes, you don't wait around. You hash it, sandbox it, check threat intel, find the source on the file server, and isolate the affected hosts while you figure out what's going on.
Full Explanation
The correct action is to hash the file, submit it to a sandbox and threat intelligence platform, identify the source on the file server, and isolate affected workstations pending analysis. Rapid distribution of a portable executable to 30 hosts in 5 minutes is an unusual pattern that warrants immediate triage: hashing and sandbox analysis help confirm maliciousness, while isolating workstations contains potential spread while investigation proceeds. Assuming the file is a legitimate software deployment and taking no action is wrong because legitimate software deployments use managed distribution channels such as SCCM or Ansible and would not exhibit this ad-hoc pattern. Blocking the file server's IP at the perimeter firewall is wrong because it does not address hosts already infected and may disrupt legitimate services. Reinstalling the operating system on all 30 workstations immediately is wrong because reimaging before forensic analysis destroys evidence and may be unnecessary if analysis shows a false positive.