CompTIA SecurityX (CAS-005)Security OperationsMedium
An organization is preparing for an advanced persistent threat (APT) campaign targeting their intellectual property. The security team wants to proactively identify potential command and control (C2) channels that might be established by the attackers. Which of the following threat hunting techniques would be most effective for this specific goal?
- AMonitoring egress network traffic for unusual beaconing patterns to external IPs.
- BPerforming static analysis on known malware samples from previous incidents.
- CReviewing active directory logs for unauthorized password changes.
- DAnalyzing historical vulnerability scan reports for unpatched systems.
Show answer & explanationAnswer & explanation
Correct answer: A. Monitoring egress network traffic for unusual beaconing patterns to external IPs.
C2 channels often involve compromised internal systems 'beaconing' out to external attacker-controlled servers at regular or seemingly random intervals. Monitoring egress network traffic for these unusual, repetitive communication patterns to external IPs is a direct and effective way to detect such channels.
Why the other options are wrong
- B. Performing static analysis on known malware samples helps understand malware capabilities but is reactive and doesn't proactively detect active C2 channels in the network.
- C. Reviewing Active Directory logs for password changes helps detect credential compromise, which is a post-exploitation activity, but not specifically C2 channels.
- D. Analyzing vulnerability scan reports helps identify initial compromise vectors, but not directly C2 channels after a breach.
C2 Channel Detection
The process of identifying covert communication pathways established by attackers to control compromised systems within a target network, often involving beaconing or unusual network traffic.
- Focuses on identifying outbound communication.
- Looks for unusual patterns (e.g., beaconing, non-standard protocols).
- Often uses DNS, HTTP/S, or custom protocols.
- Critical for detecting active compromises.
Memory trick: Listen for the hidden whispers trying to call home.