Question
You receive a security bulletin about a potential attack that uses an image file.
You need to create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to prevent the attack.
Which indicator type should you use?
- A. a URL/domain indicator that has Action set to Alert only
- B. a URL/domain indicator that has Action set to Alert and block
- C. a file hash indicator that has Action set to Alert and block Correct
- D. a certificate indicator that has Action set to Alert and block
Explanation
The threat is a specific file, so a file hash indicator identifies it wherever it appears, and the Alert and block action prevents it from being used while raising an alert. URL/domain indicators act on network locations, not on the file itself, and Alert only would not prevent the attack. Certificate indicators apply to signed executables and their signing certificates, not to an image file.
