A SOC analyst is investigating a suspected intrusion. The analyst discovers an executable that was not detected by the endpoint protection tool. The analyst wants to analyze its behavior in a controlled environment without risking production systems. Which technique BEST supports this goal?

Question

Accepted Answer

B. Submit the executable to a malware sandboxing service for dynamic behavioral analysis. A malware sandbox executes the suspicious file in an isolated environment, monitoring its behavior — system calls, network connections, file modifications, registry changes — and generating a behavioral report and IoCs. The CAS-005 V5 objectives list malware analysis and sandboxing under incident response in Security Operations.

A SOC analyst is investigating a suspected intrusion. The analyst discovers an executable that was not detected by the endpoint protection tool. The analyst wants to analyze its behavior in a controlled environment without risking production systems. Which technique BEST supports this goal?

Related Questions

Discussion