A housing SOC glossary draft must distinguish techniques that hide from antivirus from techniques that frustrate reverse engineers. Which distinction belongs in the glossary?
Select an answer to reveal the explanation.
Short Explanation
Anti-detection is ducking the guard dog; anti-analysis is ducking the lab coat. Housing SOC glossaries that split those goals stop people from treating them as the same word. Precision here pays off in triage.
Full Explanation
Anti-detection and anti-analysis are related but goal-different techniques. Anti-detection aims to evade security products and monitoring (AV, EDR, signatures, simple static indicators), while anti-analysis aims to hinder examination in labs (debuggers, sandboxes, reverse engineering). A housing SOC glossary that records that distinction improves malware reporting accuracy so hunters and reverse engineers pick the right hypotheses and tooling language.
Calling anti-detection and anti-analysis identical terms for phishing lures fails; neither term means phishing lure content, and they are not identical to each other. Saying anti-analysis only means missing patches on student portals confuses vulnerability hygiene with lab-evasion techniques. Claiming anti-detection refers exclusively to AI prompt jailbreaks conflates chatbot abuse with malware evasion of security products.
Exam caveat: GOAA Domain 6 outcomes include differentiating these mechanisms. Packed strings or AV evasion lean anti-detection; debugger/sandbox abort leans anti-analysis—though samples may use both.
Operational check for housing SOC writers: in tickets, specify whether evidence shows product evasion (e.g., obfuscation bypassing signatures) versus lab frustration (e.g., debugger exit). Assign detections and lab procedures accordingly, and reject glossary drafts that merge the terms into phishing or LLM-jailbreak language.