Which term refers to clues, artifacts, and forensic data that indicate a potential intrusion?

Which term refers to clues, artifacts, and forensic data that indicate a potential intrusion?

• A. Indicators of Compromise (IoCs)
• B. Data Staging
• C. Use of Web Shell
• D. DNS Tunneling

Answer: (A)

Indicators of Compromise are clues, artifacts, and forensic data that indicate a potential intrusion. They encompass things like known malware hashes, IP addresses or domains involved in command-and-control, unusual login times or patterns, unexpected file or registry changes, and anomalous network traffic found in logs. For defenders, IoCs are the signals used to detect, alert, and investigate breaches, guiding incident response and helping to pinpoint compromised hosts or assets across systems. The other terms refer to specific attacker techniques or steps rather than the general set of signals that suggest a breach. Data staging describes preparing data for exfiltration, a web shell is a backdoor accessed via a web server, and DNS tunneling is a covert channel method. While these may appear as IoCs, they’re individual techniques or activities, not the broad concept of indicators that signal an intrusion.

Indicators of Compromise are clues, artifacts, and forensic data that indicate a potential intrusion. They encompass things like known malware hashes, IP addresses or domains involved in command-and-control, unusual login times or patterns, unexpected file or registry changes, and anomalous network traffic found in logs. For defenders, IoCs are the signals used to detect, alert, and investigate breaches, guiding incident response and helping to pinpoint compromised hosts or assets across systems.

The other terms refer to specific attacker techniques or steps rather than the general set of signals that suggest a breach. Data staging describes preparing data for exfiltration, a web shell is a backdoor accessed via a web server, and DNS tunneling is a covert channel method. While these may appear as IoCs, they’re individual techniques or activities, not the broad concept of indicators that signal an intrusion.