Examkin

Soru

Zorluk: ZorNetwork Security Monitoring and Alerting

An enterprise security team is evaluating alert telemetry generated by a network intrusion detection system (NIDS) and netflow collectors monitoring a DMZ web server (IP address 192.168.50.14192.168.50.14). Flow telemetry demonstrates persistent outbound TCP connections initiated every 300300 seconds to an external IP address (198.51.100.45198.51.100.45) over port 443443. However, NIDS packet payload analysis reveals that the outbound traffic consists of raw, unencrypted HTTP POST requests containing base64-encoded strings rather than valid TLS handshake negotiations. Which of the following conclusions best explains this alert scenario?

  1. A
    A threat actor is conducting a SQL injection attack against the server database by sending raw SQL queries disguised as standard web payloads over port 443.
  2. An compromised internal host is using protocol tunneling and scheduled beaconing over an allowed port to maintain command-and-control communication while evading port-based filtering.Cevap
  3. C
    A deception honeypot deployed in the network segment is functioning as an inline preventive control to block malicious outbound network streams.
  4. D
    The primary remediation requires implementing host-based application patch updates on the perimeter firewall to restrict connection timing intervals.

Cevap

An compromised internal host is using protocol tunneling and scheduled beaconing over an allowed port to maintain command-and-control communication while evading port-based filtering.
The combination of regular outbound connections at fixed time intervals (beaconing) and traffic payload mismatch (unencrypted HTTP over port 443) strongly indicates an infected system establishing a covert command-and-control (C2) channel through protocol tunneling to bypass perimeter port restrictions.

Adım Adım Çözüm

1
Analyze the connection pattern in flow telemetry.
Identified periodic outbound connections occurring at precise 300-second intervals to an external address.
Regular, automated outbound intervals (beaconing) are indicative of automated malware checking in with a command-and-control (C2) server.
2
Examine packet inspection payload data for protocol mismatches.
Found unencrypted HTTP POST payloads on TCP port 443 instead of standard TLS/SSL encrypted traffic.
Attackers often use standard open outbound ports (like port 443) to tunnel non-standard or unencrypted traffic to bypass simple port-based firewall filtering.
3
Synthesize findings to determine root cause.
Confirmed covert C2 beaconing via protocol tunneling.
Combining automated interval timing with payload/port mismatch confirms malware egress beaconing and protocol evasion.

Anahtar Kavram

Network Security Monitoring, Protocol Tunneling, and Egress Beaconing Identification
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru