A security analyst is investigating a suspicious process on a Linux server. The process is running as 'nobody' (a low-privilege user) but is observed making outbound connections to various external IP addresses on high-numbered, ephemeral ports. There is no legitimate application configured to run as 'nobody' with this network behavior. Which type of malware is most likely responsible?
- ARootkit
- BBotnet (bot)
- CFile Infector
- DLogic Bomb
Show answer & explanationAnswer & explanation
Correct answer: B. Botnet (bot)
A process running as a low-privilege user ('nobody') and making 'outbound connections to various external IP addresses on high-numbered, ephemeral ports' without a legitimate reason is highly indicative of a botnet agent (bot). Bots are typically designed to communicate with a command and control (C2) server, often using random high ports to evade simple firewall rules, and often run with minimal privileges to avoid detection or reduce impact if discovered.
Why the other options are wrong
- A. A rootkit's primary function is to hide its presence and other malicious components, not necessarily to make outbound connections as a low-privilege user.
- C. A file infector attaches itself to legitimate executable files, but this doesn't explain the specific network communication pattern observed.
- D. A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met; it doesn't describe the network behavior.
Botnet (Bot) Characteristics
A botnet is a network of compromised computers (bots) controlled by a threat actor (bot-herder) via a command and control (C2) server. Bots often run with low privileges and communicate covertly with the C2.
- Performs C2 communication (often via HTTP, DNS, or custom protocols).
- Often runs as a low-privilege user.
- Used for DDoS, spam, data theft, and other malicious activities.
- May use random or high-numbered ports to evade detection.
Memory trick: A robot calling home from a hidden phone.