An employee abused PowerShell commands and script interpreters, which lead to an indicator of compromise (IOC) trigger. The IOC event shows that a known malicious file has been executed, and there is an increased likelihood of a breach. Which indicator generated this IOC event?

The scenario describes the abuse of command-line tools (PowerShell) to execute a file, which is then flagged by an Indicator of Compromise (IOC). W32 AccesschkUtility.ioc is a specific IOC used by security products like Cisco Secure Endpoint (formerly AMP for Endpoints). It triggers upon the execution of accesschk.exe, a legitimate Sysinternals tool that is frequently abused by attackers for reconnaissance to enumerate file and registry permissions. This aligns perfectly with an employee abusing command-line tools to run a file that, in this context, is part of a malicious action.

A. ExecutedMalware.ioc is too generic. Real-world IOCs are typically more specific to the malware family, tool, or behavior being observed.
B. Crossrider.ioc refers to a specific family of adware/PUPs. The question does not provide enough detail to conclude this specific family was involved.
C. ConnectToSuspiciousDomain.ioc is a network-based indicator. The IOC described in the question is related to file execution on an endpoint, not network connections.

1. Cisco, "Indicators of Compromise (IOC) Attributes for Secure Endpoint," Document ID: 118947. This document lists examples of IOCs used in Cisco's security products. While not listing this exact IOC, it describes the structure and type of IOCs used, such as those based on the execution of specific utilities ( .ioc). The use of legitimate tools for malicious purposes is a key detection category.

2. MITRE ATT&CK®, "Accesschk," Technique T1069.001 & T1069.002. The ATT&CK framework details how adversaries use the AccessChk utility for discovering permissions on local and network file shares. This abuse is what an IOC like W32 AccesschkUtility.ioc is designed to detect.