問題文
A hunting team can deny an adversary exactly one class of indicator. Denying which class makes the adversary rework the tool they are already carrying rather than merely swap a value?
選択肢
- The digest computed over the file, because the adversary has to go back and fetch a freshly built copy of the same tool from its author.
- The name the traffic resolves, because the adversary has to rewrite the part of the tool that looks that name up.
- The address the traffic goes to, because the adversary has to find another operator willing to carry the channel for them.
- The traces the tool leaves on the wire and on the host, because the tool itself has to be changed before those traces stop appearing.