Cisco CyberOps Associate (CBROPS) 200-201Security ConceptsMedium
A security analyst is investigating a series of alerts indicating that multiple internal hosts are attempting to connect to various external IP addresses on non-standard ports. The traffic patterns are sporadic and do not align with known business operations. Further investigation reveals that these internal hosts are also communicating with each other over unusual ports. What type of attack framework is most likely indicated by these observations?
- ASQL Injection
- BPhishing Campaign
- CCommand and Control (C2)
- DDenial of Service (DoS)
Show answer & explanationAnswer & explanation
Correct answer: C. Command and Control (C2)
The observed behavior of internal hosts communicating with external IP addresses on non-standard ports, coupled with internal host-to-host communication over unusual ports, is characteristic of a Command and Control (C2) framework. This framework allows attackers to maintain persistent access and control over compromised systems within a network.
Why the other options are wrong
- A. SQL Injection is a web application vulnerability used to manipulate databases, not a broader network communication pattern.
- B. Phishing campaigns are typically initial access vectors, not an ongoing network communication framework.
- D. Denial of Service (DoS) attacks primarily aim to disrupt service availability, not establish persistent communication channels.
Command and Control (C2)
A communication channel used by attackers to control compromised systems (bots or agents) within a target network. It enables attackers to issue commands, exfiltrate data, and maintain persistent access.
- Establishes persistent communication with compromised hosts.
- Uses various protocols and ports, often non-standard ones, to evade detection.
- Allows attackers to remotely manage and direct malicious activities.
- Often involves external communication to attacker-controlled infrastructure.
Memory trick: Bots Chatting Remotely