An NSM analyst observes Zeek logs showing a connection where the orig_bytes is 500 and resp_bytes is 2,500,000. The destination port is 443. What does this asymmetry suggest?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — c is correct because a small originator request (500 bytes) producing a very large response (2.5 MB) from an external server on 443 suggests the internal host retrieved a large payload, which could be malware download or data staging. A is wrong because DDoS attacks show inbound traffic volume exceeding outbound, but the source would be external and volume would appear in responder bytes hitting many connections.
Full Explanation
C is correct because a small originator request (500 bytes) producing a very large response (2.5 MB) from an external server on 443 suggests the internal host retrieved a large payload, which could be malware download or data staging. A is wrong because DDoS attacks show inbound traffic volume exceeding outbound, but the source would be external and volume would appear in responder bytes hitting many connections. B is wrong because data exfiltration from an internal host would show large orig_bytes, not large resp_bytes. D is wrong because an HTTP POST would show large originator bytes, not small originator bytes.