What are Precursors?

• A. Short-term indicators of compromise
• B. Logs of past intrusions
• C. Elements of the incident identification and response process that allow both an attacker and a security researcher to determine the existence of flaws and/or vulnerabilities within a system
• D. A vulnerability scanner

Answer: (C)

Precursors are early signals in the incident identification and response process that suggest a flaw or vulnerability may exist in a system. They act as warning signs that something could be wrong and help both defenders and attackers infer where weaknesses lie before any exploit occurs. This is why the best answer describes precursors as elements of identifying and responding to incidents that reveal the existence of flaws or vulnerabilities. They’re not the same as post-incident indicators of compromise, nor are they simply logs of past intrusions or a vulnerability scanner.