hard20 pts · first answer countsthreat-huntingdetection-engineering

When a trusted update is malicious

A widely used IT monitoring tool ships a signed update that contains a backdoor. Hash and signature checks all pass. What is the most effective way to detect it?

A.Block the vendor's certificate before the attack is knownB.Rely on antivirus signatures onlyC.Watch for behaviour that breaks the tool's baseline, such as new outbound domains, unusual child processes or access to identity systemsD.Verify the hash again with a different algorithm

Discussion 0

Join free to post in the discussion.

When a trusted update is malicious

Discussion 0

Related questions