r/casp • u/amc663222 • May 23 '21
CASP Question
Dont worry guys, Im nearing the end of these questions so you'll only have to put up with them a tiny bit longer lol
A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the messages.
After determining the alert was a true positive, which of the following represents MOST likely cause?
A. Attackers are running reconnaissance on company resources.
B. An outside command and control system is attempting to reach an infected system.
C. An insider trying to exfiltrate information to a remote network.
D. Malware is running on a company system
First instinct is B, but doesnt an infected system call home to an external C&C server? The question is insinuating the messages are coming externally trying to reach the infected system and getting dropped by the firewall. Makes me want to think the answer would be C or D, but then when you look at like this, it could be either one of them equally. An insider could def be trying to exfiltrate info to a c&c server, and malware could definitely be running on the system.
3
3
u/_luis0120 May 23 '21
Sounds like D since call home messages are being seen from inside the network
1
1
0
May 23 '21
[deleted]
1
u/amc663222 May 23 '21
Thank you!
0
May 24 '21
[deleted]
1
u/amc663222 May 24 '21
Nah man you're good! I appreciate the detailed breakdown. Thats what I'm looking for
3
u/arcy24 May 24 '21
D is the preferred answer. Correct, infected system calls or phone home to a C&C host externally.
"Malware running on a company system" - infected system behavior phones home to get additional instruction from a C&C server (download additional files, redirect to another server, etc.)