During PCAP analysis, an analyst observes an internal host sending small, periodic HTTP POST requests to an external IP every 60 seconds. Each request body contains a small amount of base64-encoded data. What does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because periodic, regular-interval HTTP POST requests with encoded payloads to an external host is a classic pattern of HTTP-based C2 beaconing where the malware checks in with its controller and may exfiltrate data. A is wrong because software update checks are typically GET requests, irregular in timing, and directed at vendor infrastructure.
Full explanation below image
Full Explanation
C is correct because periodic, regular-interval HTTP POST requests with encoded payloads to an external host is a classic pattern of HTTP-based C2 beaconing where the malware checks in with its controller and may exfiltrate data. A is wrong because software update checks are typically GET requests, irregular in timing, and directed at vendor infrastructure. B is wrong because SSL stripping would be observed as a downgrade from HTTPS to HTTP, not periodic encoded POSTs. D is wrong because web crawlers use GET requests and follow hyperlinks rather than POSTing encoded data.