During PCAP analysis, an analyst observes an internal host sending small, periodic HTTP POST requests to an external IP every 60 seconds. Each request body contains a small amount of base64-encoded data. What does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — periodic, regular-interval HTTP POST requests with encoded payloads to an external host is a classic pattern of HTTP-based C2 beaconing, where malware checks in with its controller and may exfiltrate data.
Full Explanation
HTTP-based command and control beacon with encoded data exfiltration is correct because periodic, regular-interval HTTP POST requests with encoded payloads to an external host is a classic pattern of HTTP-based C2 beaconing where the malware checks in with its controller and may exfiltrate data. A legitimate software update check using an HTTP fallback mechanism is wrong because software update checks are typically GET requests, irregular in timing, and directed at vendor infrastructure. An SSL stripping attack intercepting and downgrading HTTPS traffic is wrong because SSL stripping would be observed as a downgrade from HTTPS to HTTP, not periodic encoded POSTs. A web crawler performing automated site indexing on behalf of a search engine is wrong because web crawlers use GET requests and follow hyperlinks rather than POSTing encoded data.