Which category includes artifacts found on the host such as filenames, file hashes, registry keys, DLLs, and mutex?

Which category includes artifacts found on the host such as filenames, file hashes, registry keys, DLLs, and mutex?

• A. Behavioral indicators
• B. Atomic indicators
• C. Host-Based Indicators
• D. Computed indicators

Answer: (A)

Artifacts that exist on the endpoint—like filenames, file hashes, registry keys, loaded DLLs, and mutex objects—are host-based indicators. They are static evidence gathered from the victim’s machine that can reveal what malware or unauthorized software is present, how it persists, and how it interacts with the system. File hashes help identify known malicious files, registry keys can show persistence or autostart mechanisms, DLLs indicate libraries loaded into processes, and a mutex can signal coordinated actions or a single-instance malware check. Behavioral indicators, by comparison, describe actions or patterns over time (such as unusual processes or network traffic), not the specific artifacts stored on the host. So these artifacts on the host fit the category of host-based indicators.

Artifacts that exist on the endpoint—like filenames, file hashes, registry keys, loaded DLLs, and mutex objects—are host-based indicators. They are static evidence gathered from the victim’s machine that can reveal what malware or unauthorized software is present, how it persists, and how it interacts with the system. File hashes help identify known malicious files, registry keys can show persistence or autostart mechanisms, DLLs indicate libraries loaded into processes, and a mutex can signal coordinated actions or a single-instance malware check. Behavioral indicators, by comparison, describe actions or patterns over time (such as unusual processes or network traffic), not the specific artifacts stored on the host. So these artifacts on the host fit the category of host-based indicators.