During packet analysis of a suspected C2 channel, an analyst sees HTTP GET requests to 'http://198.51.100.10/update.php?id=AaBbCcDdEeFf1234' repeating every 60 seconds with consistent 256-byte responses. The 'id' parameter changes each iteration. What does this pattern suggest?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because regular 60-second polling with consistent response sizes, changing parameter values, and communication to a numeric IP (rather than a domain name) is consistent with C2 beaconing using HTTP as a transport, where the 'id' parameter carries encoded session data or commands. A is wrong because health checks go to specific internal or monitored endpoints and are typically configured by operations teams with known destinations.
Full explanation below image
Full Explanation
B is correct because regular 60-second polling with consistent response sizes, changing parameter values, and communication to a numeric IP (rather than a domain name) is consistent with C2 beaconing using HTTP as a transport, where the 'id' parameter carries encoded session data or commands. A is wrong because health checks go to specific internal or monitored endpoints and are typically configured by operations teams with known destinations. C is wrong because legitimate update mechanisms use recognizable domains, not numeric IPs, and show varying response sizes based on whether updates are available. D is wrong because NTP uses UDP port 123, not HTTP GET requests.