Due to reports of malware targeting companies in the same industry, an organization wants to develop a comprehensive list of IoCs to determine if its systems might be affected in a similar attack…

The correct answer is B. Sandbox detonation. By detonating threat samples in a sandbox environment, you can safely execute the malware and extract a full spectrum of indicators of compromise - file and payload hashes, dropped filenames and registry keys, network IOCs (domains, IPs, URLs), mutex names, and more. These…

Submitted by luis.pe· Mar 6, 2026Security Operations

Question

Due to reports of malware targeting companies in the same industry, an organization wants to develop a comprehensive list of IoCs to determine if its systems might be affected in a similar attack. Which of the following would be best to use to develop this list?

Options

ASimulators
BSandbox detonation
CAntivirus
DEndpoint detection and response

How the community answered

(48 responses)

A
2% (1)
B
83% (40)
C
10% (5)
D
4% (2)

Explanation

By detonating threat samples in a sandbox environment, you can safely execute the malware and extract a full spectrum of indicators of compromise - file and payload hashes, dropped filenames and registry keys, network IOCs (domains, IPs, URLs), mutex names, and more. These artifacts form a comprehensive IoC list you can then feed into your monitoring tools (EDR, SIEM, firewalls) to hunt for and block any matching activity across your environment.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice