A city SOC detection lab wants AI help improving signatures. Which generation target is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Ask AI for harmless lookalikes that make YARA blink in the lab—not for city-shaped ransomware or backup wipers. Detection engineering wants safe test shapes, not a disaster drill that is too real.
Full Explanation
City SOC detection labs seeking AI help to improve signatures should target YARA-friendly benign lookalikes designed to test signatures in a controlled lab. Those artifacts exercise rule quality (true positives, false positives, coverage of structural features) without creating production-ready destructive malware aimed at city assets. The generation goal stays defensive: better detections, safer test corpus, clear custody.
Production-ready ransomware customized to city file servers is unauthorized harmful targeting. Live wipers aimed at the backup repository 'to be thorough' attack continuity infrastructure. Public release of working exploit packs attributed to the city creates liability and aids adversaries. None of those are appropriate generation targets for municipal detection engineering.
Exam caveat: appropriate target is benign lookalikes for controlled signature testing—not real ransomware, wipers, or public exploit packs.
Operational check: define a lab corpus policy that allows AI-assisted benign lookalike generation for YARA/Sigma testing, bans destructive customization against city servers/backups, requires human review before execution, and keeps artifacts off public repositories.