Yesterday's infected DHCP address now belongs to the mayor's laptop…

Question

Yesterday's infected DHCP address now belongs to the mayor's laptop, and a malware notable names that laptop. The lease was reused after the infected host left. Which disposition is correct?

Accepted Answer

False Positive - Inaccurate Data, because the telemetry identity is wrong after lease reuse. — The address moved. Yesterday's infected kiosk is not today's mayor laptop just because DHCP reused the lease. The story about who owned the IP is bad data, so the disposition is False Positive - Inaccurate Data—not a true positive on the mayor.

Answer

True Positive - Suspicious Activity on the mayor, because the IP matches.

Answer

Benign Positive - Suspicious But Expected, because DHCP is always approved malware.

Answer

False Positive - Incorrect Analytic Logic, because the malware signature itself is invalid.

Yesterday's infected DHCP address now belongs to the mayor's laptop, and a malware notable names that laptop. The lease was reused after the infected host left. Which disposition is correct?

Short Explanation

Full Explanation