English
Menu

Cyber Attacks and Defense in Practice

An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?

  1. ADuring business hours, many employees' PCs connect to an internal file server and read and write shared files
  2. BOn a fixed day each month, many PCs receive large update files from the official update server of the OS vendor
  3. COnly one PC repeatedly sends small amounts of traffic to an unfamiliar, newly registered domain about every 60 seconds, even at night and on holidays
Show answer and explanation

Answer: C. Only one PC repeatedly sends small amounts of traffic to an unfamiliar, newly registered domain about every 60 seconds, even at night and on holidays

Malware regularly connects from the infected endpoint to an external C2 (command and control) server to receive instructions and send results. These regular connections are called beacons, and their hallmark is small traffic continuing at almost constant intervals regardless of human activity. A destination domain that was registered recently or has no reputation information is another clue that raises suspicion. However, attackers try to evade detection by adding randomness (jitter) to the intervals or relaying through legitimate cloud services, so traffic records are examined together with endpoint information collected by EDR.

  • A. Connections to an internal file server during business hours are normal business traffic.
  • B. Many PCs receiving files from the official update server on a fixed day is a normal OS update.
  • C. Correct. Traffic at constant intervals of about 60 seconds unrelated to human activity and an unfamiliar new domain are typical clues of C2 traffic.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?
  2. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  3. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?
  4. Which of the following correctly describes access control based on the idea of zero trust?
  5. The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?

Comparisons in this topic