A hunt finds a spike in command-line activity on several systems. What should distinguish malicious behavior from a scheduled administration job?

1. Compare the activity with the baseline, change records, identities, and related evidence
2. Ignore it because administration tools are always safe
3. Evaluate only the number of characters in the command
4. Treat every spike as an attack regardless of known maintenance