IOC Quiz: Identify Indicators of Compromise

Submit

3. What does detecting a web shell file in a publicly accessible directory indicate?

Web server compromise and persistent backdoor access

Normal content delivery network operation

User temporary file storage

Routine security patch deployment

Submit

5. Which of the following indicates a potential data breach in progress?

Large volume of data transferred to external IP addresses

Regular scheduled backup completion

Routine antivirus definition updates

Standard user authentication

Submit

7. What does a sudden increase in database queries from a dormant user account suggest?

Account compromise or credential theft

Natural user productivity increase

Software licensing renewal

System performance optimization

Submit

9. Which tool or log source is most useful for identifying process execution indicators?

Windows Event Viewer (Process Creation logs)

DHCP server logs

Printer event logs

Audio device logs

10. What does the presence of suspicious PowerShell scripts in the Event Viewer logs indicate?

Routine Windows updates

Potential script-based attack or lateral movement

User profile synchronization

Automatic backup completion

11. Which of the following is a network-based indicator of compromise?

Unusual outbound DNS queries to known malicious domains

Increased CPU usage during business hours

User login during standard work time

System uptime exceeding 30 days

12. Which of these is a host-based indicator of compromise?

Unusual service startup behavior

Increase in network latency

High bandwidth usage

DNS resolution delays

Submit

14. What does unusual scheduled task creation in Windows indicate?

Normal system maintenance

Potential malware persistence or lateral movement

User preference update

Software license verification

15. An encrypted file with a .exe extension appearing in a document folder is likely an indicator of which threat?

Ransomware infection

Outdated antivirus

Slow network connection

User misconfiguration

16. Which registry modification is commonly associated with persistence mechanisms used by attackers?

Run keys and startup folder entries

Display settings and theme configuration

File association defaults

Printer queue settings

Submit

18. Which file system artifact is most indicative of a recent data exfiltration?

Modified temporary files in %TEMP%

Deleted files in Recycle Bin

Large file transfers to external USB drives

Read-only file permissions

19. What does an unusual process spawning from System32 typically indicate?

Normal Windows system behavior

Potential malware or privilege escalation attempt

User profile corruption

Network connectivity issue

20. A sudden spike in failed login attempts across multiple accounts suggests which type of attack?

Brute force attack

Social engineering

Man-in-the-middle attack

Privilege escalation

IOC Quiz: Can You Spot the Breach?

1. Detecting connections to known command-and-control (C2) server IP addresses is an example of a ____-based IOC.

2.

What first name or nickname would you like us to use?

2. A suspicious .lnk file pointing to a hidden executable is an example of a ____-based IOC.

3. What does detecting a web shell file in a publicly accessible directory indicate?

4. Unauthorized changes to system files or DLL injection attempts are indicators of ____.

5. Which of the following indicates a potential data breach in progress?

6. Detecting unusual file access patterns outside normal business hours is a ____-based indicator.

7. What does a sudden increase in database queries from a dormant user account suggest?

8. An unexpected driver installation or unsigned kernel module loading is an indicator of ____.

9. Which tool or log source is most useful for identifying process execution indicators?

10. What does the presence of suspicious PowerShell scripts in the Event Viewer logs indicate?

11. Which of the following is a network-based indicator of compromise?

12. Which of these is a host-based indicator of compromise?

13. A spike in SMTP traffic on non-standard ports suggests ____.

14. What does unusual scheduled task creation in Windows indicate?

15. An encrypted file with a .exe extension appearing in a document folder is likely an indicator of which threat?

16. Which registry modification is commonly associated with persistence mechanisms used by attackers?

17. Detecting a new user account created outside normal business hours is an indicator of ____.

18. Which file system artifact is most indicative of a recent data exfiltration?

19. What does an unusual process spawning from System32 typically indicate?

20. A sudden spike in failed login attempts across multiple accounts suggests which type of attack?