A Zeek http.log entry shows: method=POST, uri=/gate.php, host=update-cdn12.net, request_body_len=48320, status_code=200. The domain was registered 3 days ago. What is the most significant indicator of compromise in this log entry?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the combination of domain age (3 days), a path name (gate.php) matching known C2 frameworks, and a large POST body (47 KB outbound) together constitute a high-confidence exfiltration/C2 indicator. A is wrong because POST is a standard HTTP method used constantly for legitimate form submissions, APIs, and uploads.
Full explanation below image
Full Explanation
B is correct because the combination of domain age (3 days), a path name (gate.php) matching known C2 frameworks, and a large POST body (47 KB outbound) together constitute a high-confidence exfiltration/C2 indicator. A is wrong because POST is a standard HTTP method used constantly for legitimate form submissions, APIs, and uploads. C is wrong because a 200 response merely indicates the remote server responded; it is neutral. D is wrong because HTTP has no standard body size limit; 48 KB is not inherently anomalous in isolation.