A company's IR policy states that all incidents must be categorized before escalation. An analyst receives a ticket: 'User reports laptop running slowly.' During triage, the analyst finds outbound connections to a known C2 IP and a persistent registry run key for an unknown binary. How should this incident be categorized?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — confirmed C2 communication and a persistence mechanism mean you're dealing with an active compromise, not just a slow laptop. You need to categorize it as Priority 1 Critical and escalate to the IR team immediately.
Full Explanation
The correct categorization is Priority 1 (Critical) — active malware infection with established C2; escalate to IR team immediately. Confirmed C2 communication and a persistence mechanism are indicators of an active compromise; the slow laptop was the symptom, not the actual problem. This meets the definition of an active intrusion requiring immediate IR team escalation. The Priority 4 (Low) — performance issue, assign to helpdesk option is wrong because triage has already uncovered definitive IOCs that go far beyond a performance issue. The Priority 3 (Medium) — possible malware; schedule a scan for next business day option is wrong because scheduling a scan for the next day allows the attacker to maintain access, exfiltrate data, or spread laterally. The Priority 2 (High) — suspected infection; ask user to run antivirus and report back option is wrong because asking the user to run AV is inadequate when C2 connectivity is confirmed; AV may be disabled by the malware.