Which category of intrusion indicators includes new or unfamiliar files, changes in file permissions, rogue files not on the signed-master list, and missing files?

Which category of intrusion indicators includes new or unfamiliar files, changes in file permissions, rogue files not on the signed-master list, and missing files?

• A. Network Intrusions
• B. System Intrusions
• C. Protocol Anomaly Detection
• D. File System Intrusions

Answer: (D)

Focusing on changes visible in the local file system is how you spot tampering at the host level. New or unfamiliar files signal that something has introduced new artifacts onto the system. Changes in file permissions point to attempts to alter access controls, which attackers often do to hide activity or broaden their reach. Rogue files not on the signed-master list indicate a deviation from the known-good baseline, meaning trusted files are being replaced or added without authorization. Missing files suggest intentional deletion or concealment to erase traces of an intrusion. Taken together, these indicators are all about the integrity and state of the file system, which is why this falls under File System Intrusions. By comparison, network intrusions show up as unusual traffic patterns, protocol anomaly detection looks for deviations in protocol behavior, and system intrusions involve things like login attempts or privilege escalation rather than file-level changes.

Focusing on changes visible in the local file system is how you spot tampering at the host level. New or unfamiliar files signal that something has introduced new artifacts onto the system. Changes in file permissions point to attempts to alter access controls, which attackers often do to hide activity or broaden their reach. Rogue files not on the signed-master list indicate a deviation from the known-good baseline, meaning trusted files are being replaced or added without authorization. Missing files suggest intentional deletion or concealment to erase traces of an intrusion. Taken together, these indicators are all about the integrity and state of the file system, which is why this falls under File System Intrusions. By comparison, network intrusions show up as unusual traffic patterns, protocol anomaly detection looks for deviations in protocol behavior, and system intrusions involve things like login attempts or privilege escalation rather than file-level changes.