To uncover undetected threats using endpoint artifacts, one should focus on:

Question

Options

• AThe most frequently visited websites
• BThe most used corporate applications
• CFile and system modifications
• DEmail usage patterns

• A
  2% (1)
• B
  7% (4)
• C
  74% (40)
• D
  17% (9)

Explanation

File and system modifications (C) are the cornerstone of endpoint threat hunting because malware, attackers, and unauthorized processes almost always leave traces in the filesystem - dropped executables, altered registry keys, new scheduled tasks, modified configuration files, or changed permissions. These artifacts persist on disk and in system logs, making them the primary evidence trail for threats that evade real-time detection.

Why the distractors fail:

• A (visited websites) - web history is useful for phishing investigations but doesn't reveal what a threat did to the system after initial access.
• B (corporate applications) - monitoring which apps are used is more of an asset inventory or DLP concern, not a forensic indicator of compromise.
• D (email patterns) - email telemetry helps detect phishing delivery, but threats that are already on the endpoint won't necessarily generate unusual email activity.

Memory tip: Think of it as a crime scene - a burglar's footprints on the floor (file/system changes) tell you what happened, not which websites they browsed or what apps they liked. Endpoint forensics = follow the file trail.

No community discussion yet for this question.