An employee abused PowerShell commands and script interpreters which lead to IOC triggers. An IOC event shows that a known malicious file ran which increased the likelihood of a successful breach…

Question

Options

• AW32.AccesschkUtility.ioc
• BConnectToSuspiciousDomain.ioc
• CExecutedMalware.ioc
• DCrossrider.ioc

• A
  6% (3)
• B
  2% (1)
• C
  89% (42)
• D
  2% (1)

Explanation

ExecutedMalware.ioc is correct because the scenario explicitly states "a known malicious file ran," which is precisely what this indicator detects - the execution of a recognized malicious binary or script. PowerShell abuse is a common delivery mechanism for malware execution, so when the malicious file launched, ExecutedMalware.ioc fired as the matching indicator.

Why the distractors are wrong:

• A (W32.AccesschkUtility.ioc) relates to the Sysinternals accesschk tool being used for privilege enumeration/reconnaissance - not malware execution.
• B (ConnectToSuspiciousDomain.ioc) triggers on outbound network connections to known-bad domains - a network IOC, not a file execution IOC.
• D (Crossrider.ioc) is specific to the Crossrider adware/browser-hijacker family - unrelated to PowerShell-delivered malware.

Memory tip: Match the IOC name to the action described. The question says a file ran - "ExecutedMalware" literally encodes both the action (executed) and the threat type (malware), making it the direct match whenever a known-bad file is launched.

No community discussion yet for this question.