A senior network security analyst is reviewing telemetry logs and protocol captures across several enterprise security incidents. Match each specific network attack type to its underlying operational mechanism and observed protocol footprint.
- NTP Amplification DDoSExploits public UDP port 123 monlist queries with a spoofed source address, yielding response payloads up to several hundred times larger than the request volume.
- Pass-the-Hash (PtH)Extracts cached NTLM or Kerberos authentication artifacts from system memory to authenticate to remote SMB/RPC services without reversing the plaintext secret.
- 802.11 Deauthentication AttackInjects spoofed unencrypted management frames to forcibly disassociate client devices from an access point, facilitating rogue AP connection or handshake capture.
- BGP Route HijackingAdvertises a more specific Autonomous System prefix via exterior gateway protocols, diverting transit traffic through attacker-controlled routing paths.
Cevap
NTP Amplification DDoS matches UDP 123 monlist amplification; Pass-the-Hash matches leveraging extracted memory authentication artifacts for SMB/RPC access; 802.11 Deauthentication Attack matches injecting spoofed unencrypted management frames; BGP Route Hijacking matches advertising more specific AS prefixes.
Each attack vector is paired directly to its unique network footprint: NTP Amplification relies on UDP 123 request/response size asymmetry via spoofed IPs; Pass-the-Hash utilizes captured credential hashes directly for SMB/RPC authentication; 802.11 Deauthentication uses spoofed unencrypted 802.11 control/management frames; and BGP Route Hijacking manipulates path selection by advertising more specific BGP IP prefixes.
Adım Adım Çözüm
Anahtar Kavram
Network Attack Vector Differentiation and Protocol Footprints