File-based IoC
Course: AP® Cybersecurity Shows up in: Unit 4: Securing Devices
An indicator of compromise found in files, such as a hash matching known malware or a known malicious file name or path.
Appears in the course and exam description (CED): 4.4.A.5
Why it matters in Unit 4
Usually found in executable files.
Example
An executable whose hash matches a known remote access trojan (RAT).
Learn it properly, with a checkpoint 4.4 Detecting Attacks on Devices