During a recent internal purple team exercise, the following recommendation is given to the detection engineering team: Detect and prevent command line invocation of Python on Windows endpoints by…

Question

Options

• AAnalytics Behavioral Indicator of Compromise (ABIOC)
• BBehavioral Indicator of Compromise (BIOC)
• CCorrelation
• DIndicator of Compromise (IOC)

• A
  3% (1)
• B
  75% (30)
• C
  15% (6)
• D
  8% (3)

Explanation

B (BIOC) is correct because a Behavioral Indicator of Compromise detects suspicious actions or patterns that deviate from expected activity - in this case, the policy-violating behavior of non-technical users invoking Python via the command line. BIOCs are deterministic, rule-based detections tied to specific behaviors rather than known-bad artifacts.

A (ABIOC) is wrong because Analytics BIOCs use machine learning and statistical baselining to surface anomalies - not a fixed, hand-written rule like "flag Python.exe spawned by HR." The scenario describes a deliberate, deterministic policy rule, not an ML-driven detection.

C (Correlation) is wrong because correlation rules link multiple events or data sources together to identify a threat pattern; this scenario involves a single, discrete event type, so no cross-event correlation is needed.

D (IOC) is wrong because a classic IOC is a static artifact - a file hash, IP, domain, or registry key - not an observed action. Python being launched by the wrong user group is a behavior, not a concrete artifact to match.

Memory tip: Use the "artifact vs. action" split - IOC = thing (hash, IP), BIOC = action (process launched, command run). If the rule fires based on who did what, it's a BIOC. If ML/baselining is involved, upgrade to ABIOC.

No community discussion yet for this question.