A Zeek conn.log entry shows a connection with a duration over 8 hours, consistent byte counts throughout, and a destination on port 4444. What does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because long-duration connections on non-standard ports with consistent low-volume traffic patterns are characteristic of persistent backdoors or reverse shells maintaining a C2 channel. Port 4444 is commonly associated with Metasploit reverse shells.
Full explanation below image
Full Explanation
B is correct because long-duration connections on non-standard ports with consistent low-volume traffic patterns are characteristic of persistent backdoors or reverse shells maintaining a C2 channel. Port 4444 is commonly associated with Metasploit reverse shells. A is wrong because file transfers have a defined beginning and end rather than 8-hour persistent connections with regular byte patterns. C is wrong because printers use well-known protocols on standard ports. D is wrong because DDoS attacks involve high-volume traffic to or from many sources, not a single long-lived low-throughput connection.