A SOC analyst observes a SIEM alert for an internal host making HTTP connections to 50 different external IP addresses in 10 minutes, all on port 80, with 8-byte responses and no follow-on traffic. What does this most likely indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — rapid HTTP hits to 50 external addresses with 8-byte responses and no follow-on traffic scream malware running a fast check-in scan across multiple command-and-control servers, possibly using a backup command-and-control list. You're seeing malware probing for an active server, not normal browsing, DNS load balancing, or Windows Update.
Full Explanation
Rapid HTTP connections to many distinct external addresses with tiny fixed responses and no follow-on traffic indicate malware conducting a fast check-in scan across multiple command-and-control servers, possibly using a backup command-and-control list. This suggests malware iterating through a list of potential command-and-control servers to find an active one, common in backup command-and-control lists or domain fluxing.
The browsing-multiple-websites scenario is wrong because browser traffic shows varied response sizes from HTML content, DNS lookups per domain, and an interactive pattern, not 8-byte responses to 50 addresses in 10 minutes. The fast-flux DNS resolution pattern used by CDN providers for load balancing is wrong because fast-flux affects domain resolution, not a client connecting directly to 50 different addresses. The Windows Update process checking multiple Microsoft servers for patch availability is wrong because Windows Update uses specific Microsoft CDN domains, not 50 random external addresses with 8-byte responses.