FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

Question

During analysis of a packet capture taken from a compromised workstation, you observe a high volume of outbound connections directed at one unfamiliar external IP address, using a non-standard port. The payload of this traffic is small (1KB) and does not match any recognizable standard protocol such as HTTP or HTTPS.

Which malware behavior does this most strongly indicate?

Explanation

A pattern of numerous outbound connections to a single external IP address over a non-standard port, carrying small, unrecognized payloads, is a hallmark of C2 beaconing. Infected hosts routinely 'check in' with their C2 server using small heartbeat or status messages, often over non-standard ports and using custom or obfuscated protocols to evade detection, rather than transferring large amounts of data (which would suggest exfiltration) or connecting to multiple peers/hosts (which would suggest P2P malware or worm propagation).

FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

AstroTutor

Notes

Readiness

QuestionQ43

Community Discussion