Question

Which of the following is (are) sign(s) of C2 (command & control) traffic outbound from a network?

a. Connection to a specific domain regularly in exactly same time intervals.

b. Lower count of HTTP GET requests with unique User-Agent within header.

c. HTTP traffic to destination with expired or revoked SSL Certificate.

d. All of the above.

Answer 1

The sign of command and control traffic outbound from a network are connection to a specific domain regularly in exactly same time interval and lower count of HTTP get request with unique user agent within header, HTTP traffic to destination with revoked SSL certificate .

Option D (All of the above) is correct