An analyst notices that a workstation is making regular outbound connections to an unfamiliar host
at 03:00 every night, several days after a staff member opened an email attachment. No files have
been encrypted and nothing has yet been stolen.
Which stage of the malware attack lifecycle does this behaviour represent, and what does
blocking it achieve?

Question

An analyst notices that a workstation is making regular outbound connections to an unfamiliar host
      at 03:00 every night, several days after a staff member opened an email attachment. No files have
      been encrypted and nothing has yet been stolen. 
       Which stage of the malware attack lifecycle does this behaviour represent, and what does
      blocking it achieve?

Answer

Command-and-control; breaking this stage prevents the attacker issuing the instructions that lead to the final actions on objectives.

Answer

Delivery; blocking it removes the malware that is already installed on the workstation.

Answer

Exploitation; blocking it prevents the original vulnerability from ever being triggered.

Answer

Actions on objectives; blocking it is pointless because the damage stage has already completed.

Crowdly

An analyst notices that a workstation is making regular outbound connections to ...

Want instant access to all verified answers on online.codl.lk?