An analyst is analyzing a PCAP file and identifies a TCP stream where large volumes of data are sent from an internal host to an external destination over port 443, but the traffic patterns do not match standard TLS handshake sequences. What should the analyst investigate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because attackers and malware often tunnel custom C2 protocols over port 443 specifically because most firewalls permit HTTPS outbound; traffic lacking proper TLS handshake patterns on port 443 may indicate a custom tunneling protocol designed to blend with allowed HTTPS traffic. A is wrong because expired certificates cause TLS handshake errors and typically result in refused connections, not large data flows.
Full explanation below image
Full Explanation
B is correct because attackers and malware often tunnel custom C2 protocols over port 443 specifically because most firewalls permit HTTPS outbound; traffic lacking proper TLS handshake patterns on port 443 may indicate a custom tunneling protocol designed to blend with allowed HTTPS traffic. A is wrong because expired certificates cause TLS handshake errors and typically result in refused connections, not large data flows. C is wrong because TLS compatibility issues cause connection failures, not large successful data transfers with non-standard patterns. D is wrong because packet drops cause missing segments, not completely different traffic patterns.