A SOC analyst observes a SIEM alert for an internal host making HTTP connections to 50 different external IP addresses in 10 minutes, all on port 80, with 8-byte responses and no follow-on traffic. What does this most likely indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because rapid connections to many distinct external IPs with tiny fixed responses and no follow-on traffic suggests malware iterating through a list of potential C2 servers to find an active one (common in backup C2 lists or domain fluxing). A is wrong because browser web traffic shows varied response sizes (HTML content), DNS lookups per domain, and interactive pattern, not 8-byte responses to 50 IPs in 10 minutes.
Full explanation below image
Full Explanation
C is correct because rapid connections to many distinct external IPs with tiny fixed responses and no follow-on traffic suggests malware iterating through a list of potential C2 servers to find an active one (common in backup C2 lists or domain fluxing). A is wrong because browser web traffic shows varied response sizes (HTML content), DNS lookups per domain, and interactive pattern, not 8-byte responses to 50 IPs in 10 minutes. B is wrong because fast-flux is a DNS technique affecting domain resolution, not a traffic pattern where the client connects to 50 different IPs directly. D is wrong because Windows Update communicates with specific Microsoft CDN domains, not 50 random external IPs with 8-byte responses.