CompTIA CySA+ CS0-003 Question # 102 Topic 11 Discussion

Adding the SHA-256 hash of a legitimate Microsoft-signed binary like svchost.exe to detection signatures would result in the indicator firing on the majority of Windows devices. Svchost.exe is a common and legitimate system process used by Windows, and using its hash as an indicator ofcompromise (IOC) would generate numerous false positives, as it would match the legitimate instances of svchost.exe running on all Windows systems.