CS0-003 · Question #432
A list of loCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost. exe. Which of the following best describes the result if…
The correct answer is A. This indicator would fire on the majority of Windows devices. Adding the SHA-256 hash of a legitimate Microsoft-signed binary like svchost.exe to detection signatures would result in the indicator firing on the majority of Windows devices. Svchost.exe is a common and legitimate system process used by Windows, and using its hash as an…
Question
A list of loCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost. exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?
Options
- AThis indicator would fire on the majority of Windows devices.
- BMalicious files with a matching hash would be detected.
- CSecurity teams would detect rogue svchost. exe processes in their environment.
- DSecurity teams would detect event entries detailing executionof known-malicious svchost. exe
How the community answered
(37 responses)- A73% (27)
- B5% (2)
- C16% (6)
- D5% (2)
Explanation
Adding the SHA-256 hash of a legitimate Microsoft-signed binary like svchost.exe to detection signatures would result in the indicator firing on the majority of Windows devices. Svchost.exe is a common and legitimate system process used by Windows, and using its hash as an indicator of compromise (IOC) would generate numerous false positives, as it would match the legitimate instances of svchost.exe running on all Windows systems.
Topics
Community Discussion
No community discussion yet for this question.