Question

Name three indicators that are valid IOC rules.

a) Hash, IP, File Name
b) User Activity, Network Connection, Timestamp
c) Process Tree, File Permissions, Registry Key
d) MAC Address, Log Details, Endpoint Event

Answer 1

Three valid IOC rules are Hash, IP, and File Name.

Step-by-step explanation:

Three valid IOC (Indicators of Compromise) rules are:

1. Hash: A cryptographic hash function that computes a fixed-size hash value for a given input. It can be used to identify if a file has been altered or is known to be malicious.
2. IP: The Internet Protocol address, which uniquely identifies each device on a network. It can be used to track suspicious network activity or connections.
3. File Name: The specific name or path of a file, which can indicate if it is associated with known malware or malicious activity.