Which of the following is not an Atomic Indicator?

• A. IP address
• B. Hash of a malicious file
• C. Static string in a covert C2 channel
• D. FQDN

Answer: (B)

Atomic indicators are the simplest, stand-alone signals you can observe directly as artifacts of activity. They map to concrete items you can detect without needing to infer from context. An IP address is a clear network endpoint you can monitor on the wire. A fully qualified domain name is another direct endpoint that can be watched in DNS traffic or logs. A static string appearing in a covert C2 channel is a concrete pattern you can search for in payloads or traffic.

In contrast, a hash of a malicious file is a property of a file, and it only matters if you already know the exact sample or you have the file to compare against a database. Malware tends to change across variants, so a single hash isn’t a robust, standalone signal you can rely on for detection across campaigns. It’s useful, but not an Atomic Indicator in this context.