CS0-003 · Question #542
An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigative actions would…
The correct answer is D. Review the attachment's behavior in a sandbox environment while running Wireshark. To determine if a suspicious file attachment is malicious, especially if it's potentially custom-crafted, observing its dynamic behavior in an isolated sandbox environment is the most effective method.
Question
An end user forwarded an email with a file attachment to the SOC for review. The SOC analysts think the file was specially crafted for the target. Which of the following investigative actions would best determine if the attachment was malicious?
Options
- AReview the file in Virus Total to determine if the domain is associated with any phishing.
- BReview the email header to analyze the DKIM, DMARC, and SPF values.
- CReview the source IP address in AbuseIPDB.
- DReview the attachment's behavior in a sandbox environment while running Wireshark.
How the community answered
(27 responses)- A4% (1)
- B11% (3)
- C4% (1)
- D81% (22)
Why each option
To determine if a suspicious file attachment is malicious, especially if it's potentially custom-crafted, observing its dynamic behavior in an isolated sandbox environment is the most effective method.
VirusTotal scans the file against known signatures and hashes, but a specially crafted or zero-day malware might not be detected; also, reviewing the domain is not directly testing the attachment itself.
Analyzing email headers (DKIM, DMARC, SPF) helps verify the email sender's authenticity and detect spoofing, but it does not determine if the attachment itself is malicious.
Checking the source IP in AbuseIPDB might indicate if the sender's IP has a bad reputation, but it doesn't confirm the maliciousness of the specific attachment or its behavior.
Running the attachment in a sandbox environment allows for dynamic analysis, safely executing the suspicious file in an isolated system to observe its real-time behavior, such as file system modifications, registry changes, or process injections. Combining this with Wireshark will capture any network communications the malware attempts, providing crucial indicators of compromise (IOCs) and confirming its malicious nature.
Concept tested: Malware Analysis (Dynamic Sandbox)
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-for-endpoint/automated-investigation-sandbox
Topics
Community Discussion
No community discussion yet for this question.