A Security Operations Center (SOC) analyst is reviewing network security monitoring alerts generated by a Network Traffic Analysis (NTA) sensor inspecting perimeter egress traffic. The sensor triggers a high-severity alert for an outbound TCP session originating from an internal host () to an external server ():
src_ip: 10.2.14.50
src_port: 51024
dest_ip: 198.51.100.89
dest_port: 443
transport: tcp
detected_protocol: ssh
expected_protocol: tls
alert_type: Protocol Mismatch / Evasion
Based on the log snippet provided, which of the following is the most accurate interpretation of this network security monitoring alert?
- An internal host is attempting to bypass perimeter egress filtering by tunneling SSH traffic over standard HTTPS port 443.Cevap
- BA remote attacker is executing a SQL injection attack against an internal database server by encapsulating SQL commands in TLS payloads.
- CThe perimeter network monitoring sensor functioned as a preventive control by dropping packets associated with an unverified TLS certificate.
- DA production honeypot triggered an alert after capturing an inbound unauthorized connection attempt on a deceptive service listener.
Cevap
The alert indicates an internal host attempting to bypass perimeter egress filtering by tunneling SSH traffic over standard HTTPS port 443.
The NTA sensor alert highlights a protocol mismatch where an outbound session on TCP port 443 (typically allocated for HTTPS/TLS) contains SSH protocol signatures. Adversaries and users frequently attempt to evade perimeter security controls and firewall restrictions by encapsulating unauthorized protocols (such as SSH) over common outbound ports like 443.
Adım Adım Çözüm
Anahtar Kavram
Network Security Monitoring and Protocol Anomaly Detection
Tahmini Süre:1m 30s