A SOC analyst is investigating a recent email delivered to a high-value user for a customer whose network their organization monitors. The email includes a suspicious attachment titled "Invoice RE: 0004489". The hash of the file is gathered from the Cisco Email Security Appliance. After searching Open Source Intelligence, no available history of this hash is found anywhere on the web. What is the next step in analyzing this attachment to allow the analyst to gather indicators of compromise?
A) Run and analyze the DLP Incident Summary Report from the Email Security Appliance
B) Ask the company to execute the payload for real time analysis
C) Investigate further in open source repositories using YARA to find matches
D) Obtain a copy of the file for detonation in a sandbox

Question

Quizplus · Accepted Answer

Detonating the file in a sandbox allows the analyst to safely observe the behavior of the attachment and gather indicators of compromise without risking the network.

A SOC Analyst Is Investigating a Recent Email Delivered to a High-Value