A file-integrity monitoring (FIM) agent on a finance employee's Windows 11 laptop reports the following four file-system events during a two-minute window when no software updates were authorized:
C:\Users\j.smith\Documents\Training\marketing_video.mp4 (35 MB) - created
E:\Backups\2025-09-10\finance_reports.zip (AES-256 encrypted) - created
C:\Windows\System32\svch0st.dll (176 KB) - created
Endpoint-protection signatures are current, and the user has normal (non-admin) privileges. Which file-system event should the security analyst escalate first as the clearest indicator of potentially malicious activity?
Creation of an encrypted finance_reports.zip file in the backup directory
Creation of svch0st.dll in C:\Windows\System32
Creation of marketing_video.mp4 in the user's Documents folder
Modification of ProjectPlan.docx in the user's Downloads folder
Creating an unexpected DLL inside the protected C:\Windows\System32 directory is a strong host-based indicator of compromise. Malware frequently drops or replaces DLLs in System32 to gain persistence or privilege escalation, and legitimate user-level activity rarely writes new binaries there. The filename svch0st.dll also mimics the legitimate svchost.exe process-a common masquerading technique. The other events can stem from normal user behavior: large media files and modified Office documents are typical, and encrypted ZIP archives are common outputs of backup or archiving tools. While they may merit review, none provides as direct evidence of unauthorized tampering with core operating-system areas as an unapproved binary appearing in System32.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why is the creation of svch0st.dll in C:\Windows\System32 considered a strong indicator of malicious activity?
Open an interactive chat with Bash
What is the significance of the svch0st.dll filename resembling svchost.exe?
Open an interactive chat with Bash
What makes unauthorized DLL creation in System32 riskier than other file-system events in this scenario?