Examkin

Soru

Zorluk: Çok zorNetwork and Wireless Attack Indicators

An incident response team is investigating multiple concurrent network and wireless security anomalies detected across enterprise infrastructure. Match each technical log entry or packet capture indicator to its correct attack classification.

  • Wireless packet capture shows a burst of 802.11 management frames containing spoofed BSSID header information sending 0x0007 reason codes to client MAC addresses, immediately followed by clients authenticating to an unauthorized Access Point broadcasting identical SSID credentials on an adjacent channel.Rogue AP / Evil Twin Attack
  • Core switch ARP tables reveal rapid mapping updates associating the default gateway IP address with an unknown host MAC address `00:E0:4C:12:34:56`, accompanied by unrequested ICMP Type 5 redirect frames targeting the subnet host interfaces.ARP Poisoning / On-Path (MitM) Attack
  • Internal DNS resolver logs register continuous high-frequency recursive queries requesting resolution for randomized 64-character hexadecimal subdomains appended to `malicious-domain.external`, exhibiting consistent packet sizes and strict 15-second beacon interval timing.DNS Tunneling / Data Exfiltration
  • Wireless Intrusion Detection System (WIDS) alerts report a massive influx of WPA2/WPA3 4-way handshake message 1 frames loaded with invalid Message Integrity Check (MIC) counters and randomized nonces, triggering widespread AP memory pool exhaustion and client disconnection.Wireless Disassociation / Key Reinstallation DoS

Cevap

The correct pairings match 802.11 disassociation/rogue BSSID capture to Evil Twin Attack, gratuitous ARP/ICMP redirect log signatures to ARP Poisoning / On-Path Attack, high-entropy subdomain lookup traffic to DNS Tunneling / Data Exfiltration, and invalid MIC handshake floods to Wireless Disassociation / Key Reinstallation DoS.
Each indicator presents unambiguous packet headers and protocol behaviors specific to its corresponding threat vector: 802.11 disassociation and rogue BSSID credentials characterize Evil Twin attacks; unsolicited ARP resolution re-binding default gateways characterizes ARP Poisoning; high-entropy DNS subdomains indicate DNS Tunneling; and malformed EAPOL/handshake MIC floods characterize Wireless DoS attacks.

Adım Adım Çözüm

1
Analyze the wireless capture indicator containing 802.11 management disassociation frames and unauthorized BSSID re-authentication.
Identify that disconnecting clients from a legitimate BSSID to trick them into connecting to a rogue AP broadcasting the same SSID indicates an Evil Twin attack.
Evil Twin attacks use forced disassociation frames to drive client devices to associate with an attacker-controlled AP.
2
Examine switch ARP table updates mapping the gateway IP to an unknown MAC along with ICMP Type 5 redirects.
Confirm ARP Poisoning / On-Path attack.
Manipulating Layer 2 IP-to-MAC bindings diverts subnet traffic through the attacker's network interface.
3
Evaluate internal DNS resolver logs showing high-frequency requests with high-entropy subdomains.
Classify the activity as DNS Tunneling / Exfiltration.
Encoding binary data into long, randomized subdomains sent to an authoritative external DNS server bypasses standard perimeter security filters.
4
Inspect WIDS alerts showing 4-way handshake frame flooding with corrupt MIC tags.
Match this indicator to Wireless Disassociation / Key Reinstallation DoS.
Malformed handshake frame injection causes target APs and clients to fail cryptographic negotiation, resulting in service disruption.

Anahtar Kavram

Identification of Network and Wireless Attack Signatures
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Network and Wireless Attack Indicators

Bu konudan daha fazla soru