According to Microsoft Defender for Endpoint documentation, Indicators of Compromise (IoCs) can be created based on file hashes, IPs, URLs/domains, or certificates . When the bulletin references a potential attack that uses an image file , it implies that the malicious component is a specific file type (e.g., .jpg , .png , .
ico ) being weaponized.
The appropriate IoC for file-based threats is a File hash indicator . You create this indicator by specifying the hash (SHA-1, SHA-256, or MD5) of the suspicious file and setting its Action to "Alert and block" , which ensures that Defender for Endpoint both raises an alert and prevents execution of the file on protected endpoints.
From Microsoft documentation:
"You can create indicators for file hashes, IP addresses, URLs/domains, and certificates. When creating file hash indicators, set the action to Alert and block to prevent execution of known malicious files on endpoints." Other options explained:
* A & B (URL/domain) - These are used for blocking malicious websites or command-and-control domains, not image files.
* D (Certificate) - Used for detecting or blocking applications signed with malicious certificates, not for specific file-based threats.
# Correct Answer: C. a file hash indicator that has Action set to Alert and block