1answer.
Ask question
Login Signup
Ask question
All categories
  • English
  • Mathematics
  • Social Studies
  • Business
  • History
  • Health
  • Geography
  • Biology
  • Physics
  • Chemistry
  • Computers and Technology
  • Arts
  • World Languages
  • Spanish
  • French
  • German
  • Advanced Placement (AP)
  • SAT
  • Medicine
  • Law
  • Engineering
SVEN [57.7K]
3 years ago
12

An organization’s SOC analyst, through examination of the company’s SIEM, discovers what she believes is Chinese-state sponsored

espionage activity on the company’s network. Management agrees with her initial findings given the forensic artifacts she presents are characteristics of malware, but management is unclear on why the analyst thought it was Chinese-state sponsored. You have been brought in as a consultant to help determine 1) whether the systems have been compromised and 2) whether the analyst’s assertion has valid grounds to believe it is Chinese state-sponsored. What steps would you take to answer these questions given that you have been provided a MD5 hashes, two call back domains, and an email that is believed to have been used to conduct a spearphishing attack associated with the corresponding MD5 hash. What other threat intelligence can be generated from this information and how would that help shape your assessment?
Computers and Technology
1 answer:
Vinil7 [7]3 years ago
3 0

Answer: Provided in the explanation segment

Explanation:

Below is a detailed explanation to make this problem more clearer to understand.

(1). We are asked to determine whether the systems have been compromised;

Ans: (YES) From the question given, We can see that the System is compromised. This is so because the plan of communication has different details of scenarios where incidents occur. This communication plan has a well read table of contents that lists specific type of incidents, where each incident has a brief description of the event.

(2). Whether the analyst’s assertion has valid grounds to believe it is Chinese state-sponsored.

Ans: I can say that the analyst uses several different internet protocol address located in so as to conduct its operations, in one instance, a log file recovered  form an open indexed server revealed tham an IP address located is used to administer the command control node that was communicating with the malware.

(3). What other threat intelligence can be generated from this information?

Ans: The threat that can be generated from this include; Custom backdoors, Strategic web compromises, and also Web Server  exploitation.

(4). How would that help shape your assessment?

Ans: This helps in such a way where information is gathered and transferred out of the target network which involve movement of files through multiple systems.

Files also gotten from networks as well as  using tools (archival) to compress and also encrypt data with effectiveness of their data theft.

cheers i hope this helped!!!

You might be interested in
Plz help code practice for python
laila [671]

Answer:umm

Explanation:

6 0
3 years ago
Read 2 more answers
When I’m design view, Henrietta deleted a previous criterion, added a new column, and filtered patients’ age. Which best describ
BaLLatris [955]

Answer:

Explanation:

b

8 0
3 years ago
Write a class named GasTank containing: An instance variable named amount of type double, initialized to 0. An instance variable
telo118 [61]

Answer:

The class GasTank is defined below

All the steps are briefed in comments

public class GasTank {

// instance variable initialization

private double amount = 0;

//declaring instance variable capacitance

private double capacity;

//constructor having parameter of type double

public GasTank(double i)

{

capacity = i;

}

// addGas method for increasing gas quantity.

public void addGas(double i)

//quantity of gas increased is added to the existing amount. If it becomes more than total capacity, amount is set to capacity

{ amount += i; if(amount > capacity) amount = capacity; / amount = amount < capacity ? amount+i : capacity;/ }

//useGas method having parameter of type double

public void useGas(double i)

//the parameter given is deducted from 0 and if results less than 0, remains equal to 0

{ amount = amount < 0 ? 0 : amount - i; }

//method isEmpty

public boolean isEmpty()

//Returns true if volume is less than 0.1 else false

{ return amount < 0.1 ? true : false; }

//method isFull

public boolean isFull()

//returns true if the value of amount is greater than  0.1 else false.

{ return amount > (capacity-0.1) ? true : false; }

//method getGasLeve

public double getGasLevel()

//Returns the value of amount instance variable

{ return amount; }

//method fillUp

public double fillUp()

//returns the difference between the capacity and the amount

{ double blah = capacity - amount; amount = capacity; return blah; }

}

5 0
4 years ago
Which sequence of slides would be followed in a linear slideshow? A. slide 4 -&gt; slide 5 -&gt; slide 6 -&gt; slide 7 B. slide
Nina [5.8K]

i dont understand your qeution to be able to answer it

8 0
3 years ago
Read 2 more answers
How many nibbles are in 18 bytes??
IgorC [24]
36 Nibbles are in 18bytes.
7 0
4 years ago
Other questions:
  • In window explorer, the opposite of expanding a folder is?
    11·2 answers
  • Google Apps are an example of​ ________. A. platform as a service​ (PaaS) B. software as a product​ (SaaP) C. platform as a prod
    7·1 answer
  • When creating a new user in linux, after entering the name, the username box:?
    9·1 answer
  • Some touch screens recognize when you touch the screen with two fingers or two hands. If you are looking for a device on which y
    11·1 answer
  • Why is ipsec considered to be a transparent security protocol?
    6·1 answer
  • Who watches Riverdale ? if you do can we be friends(pLEASE DON'T DELETE) and also who is your fav character from Riverdale
    8·2 answers
  • After turning volume all the way up on your computer speaker you still can’t hear any sound. What should be done next
    15·1 answer
  • Click this link to view O*NET’s Work Activities section for Manicurists and Pedicurists. Note that common activities are listed
    8·1 answer
  • In java language I want the code
    15·1 answer
  • The short-range two-way communication technology behind contactless payments is called ____.
    15·1 answer
Add answer
Login
Not registered? Fast signup
Signup
Login Signup
Ask question!