Malware and AI-Assisted Investigations

An analyst notices that an AI-powered detection tool is flagging legitimate administrative PowerShell scripts as malicious. Which approach should the analyst take to improve model precision?

A junior analyst is using an AI-powered malware analysis tool to examine a suspicious executable. The tool provides a summary indicating that the file is 'likely malicious' with a confidence score of 65%. The analyst is unsure how to proceed. According to incident response best practices, what should the analyst do NEXT?

An analyst is training a machine learning model to classify malware families. Which data preparation technique is most critical to prevent bias in the classification results?

You are leading an incident response effort against a sophisticated adversary who uses AI-generated polymorphic malware that changes its code signature on each execution. Your team employs AI-assisted tools for detection and analysis. Which TWO of the following techniques are MOST effective for identifying and tracking this malware across multiple hosts? (Choose two.)

Which TWO of the following strategies are most effective when using AI tools to assist in the analysis of large-scale, automated malware logs?

A GCIH incident handler is investigating a Linux server that an AI-based anomaly detector flagged for unusual outbound traffic. The handler suspects the server is beaconing to a C2 server but the traffic is encrypted and the beacon interval appears randomized. The handler has a packet capture and wants to apply a technique that can identify the beaconing pattern despite the randomization. Which approach should the handler use?

Refer to the exhibit. The log shows a low-confidence alert from an AI tool. How should an incident responder proceed?

Which capability is most important for a modern incident response team to maintain when integrating AI tools into their workflow?

A junior incident handler is reviewing an alert from an AI-powered email security gateway that flagged a message as a likely AI-generated phishing attempt. The gateway's model outputs a confidence score but no explanation. The handler wants to gather corroborating evidence from the message headers and body to support the classification before escalating. Which artifact would best help the handler verify that the message was generated or augmented by an AI tool?

An attacker has compromised a host and established persistence using a malicious scheduled task that executes an encoded PowerShell command. The command downloads a second-stage payload from a legitimate cloud storage service. Your AI-assisted EDR has flagged the activity but provided only a low-confidence alert. As the incident responder, you need to determine the next investigative step. Which of the following actions is MOST likely to yield actionable intelligence about the second-stage payload?

An AI-assisted investigation tool summarizes a week of EDR telemetry and reports that a workstation 'likely performed credential dumping.' The summary cites no specific process, command line, or timestamp. What should the incident handler do first?

When investigating an AI-generated spear-phishing campaign, what is the most effective indicator to look for that suggests the content was created by a Large Language Model (LLM)?

An analyst discovers that an attacker is using AI to dynamically change the command-and-control (C2) infrastructure based on defensive responses. Which IR strategy is best suited to disrupt this behavior?

Which THREE of the following are essential components of an effective AI-assisted malware hunting strategy?

During a malware investigation, you discover that the adversary is using an AI model to generate domain names for its command-and-control (C2) infrastructure. The domains appear legitimate and are registered in bulk. Your AI-assisted threat hunting platform uses domain generation algorithm (DGA) detection but is missing these domains. Which of the following is the MOST likely reason for the detection failure?

An analyst uses an AI assistant to summarize a malware report and generate response steps. Before executing any recommended commands on production systems, what is the most important action?

Which of the following is a classic example of an 'adversarial' attack against an AI-powered detection engine?

Which of the following is the primary risk associated with using unvetted AI models for malware signature generation?

Refer to the exhibit. An AI-based EDR identifies a suspicious process chain. Based on the provided JSON output, what is the most appropriate next step for an incident handler?

During an incident, you capture a suspicious binary that evades static detection. You submit it to an AI-based malware analysis platform, which returns a confidence score of 0.55 and flags 'possible packer.' The binary has not yet been detonated. What should you do next?