A university sandbox URL list contains the campus update server and one newly registered domain. Which contact should the analyst treat as the lead?
Select an answer to reveal the explanation.
Short Explanation
In a list of places a sample called, the familiar campus update server is the cafeteria, and the new domain is the stranger. You follow the newly registered domain, and you treat the update server as expected. The trap is calling every URL hostile, reading the hash as a URL, or crowning the longest URL as command and control.
Full Explanation
The URL list has two kinds of contact: the campus update server, which the university expects, and one newly registered domain, which the report did not already treat as normal. The lead is the unexpected contact. That lead is "The newly registered domain, the unexpected contact, while the campus update server is the ordinary one". Calling every URL hostile ignores the known updater, so "Every URL on the list is equally hostile, including the campus update server" fails. A hash identifies file content. It is not a URL the sample contacted, so "The file hash, read as if it were a URL the sample contacted during detonation" fails. Command and control is not awarded by string length. The longest URL is not the lead for that reason, so "The longest URL on the list, treated as command and control purely by its length" fails. Exam caveat: a newly registered domain can still be a legitimate new service, and it is the lead here because it is the unexpected contact beside a known updater. Operational check: match the update-server URL to the known campus updater, and pivot the case on the domain that is not that host.