Host-based IoC
Course: AP® Cybersecurity Shows up in: Unit 4: Securing Devices
An indicator of compromise found in logs and configuration settings, such as unexpected processes or unauthorized setting changes.
Appears in the course and exam description (CED): 4.4.A.4
Why it matters in Unit 4
Look for change nobody approved.
Example
A new service installed overnight with no change request.
Learn it properly, with a checkpoint 4.4 Detecting Attacks on Devices