Host-based indicators are found on _____ systems.

• A. Server
• B. Attacker
• C. Database
• D. Infected

Answer: (D)

Host-based indicators of compromise are artifacts that reside on the compromised machine itself. They are found on the host that has been infected by malware, such as unusual processes, registry changes, new startup items, suspicious scheduled tasks, or altered logs on that machine. Because these indicators live on the infected system, they’re detected by examining the endpoint directly rather than through network traffic or external sources. Among the options, the indicators would be found on the infected system, since that’s where the malware leaves traces.