Refer to the exhibit. A network engineer is analyzing a Wireshark file to determine the HTTP request that caused the initial Ursnif banking Trojan binary to download. Which filter did the engineer…

Question

Exhibit

Options

• Ahttp.request.un matchesEvidence gathering must avoid exposure of data from
• Btls.handshake.type ==1
• Ctcp.port eq 25
• Dtcp.window_size ==0

• A
  6% (2)
• B
  79% (27)
• C
  12% (4)
• D
  3% (1)

Explanation

Explanation

Option B (tls.handshake.type == 1) is correct because this Wireshark filter captures TLS Client Hello messages, which represent the initial handshake when a client attempts to establish an encrypted HTTPS connection - this is precisely how malware like Ursnif initiates contact with its command-and-control (C2) server or download source, making it the ideal filter to identify the suspicious initial HTTP/HTTPS request that triggered the binary download.

Option A is incorrect (and malformed) because http.request.un is not a valid Wireshark filter, and while HTTP request filters can be useful, they would miss encrypted traffic where the Ursnif download likely occurred. Option C (tcp.port eq 25) filters for SMTP email traffic, which is irrelevant to identifying an HTTP-based malware download. Option D (tcp.window_size == 0) filters for TCP zero-window conditions indicating flow control issues, which has no relevance to isolating malware download requests.

Memory Tip: Think "Type 1 = First Hello" - TLS handshake type 1 is the Client Hello, the very first encrypted connection attempt, making it perfect for catching malware "reaching out" for the first time to download its payload.

No community discussion yet for this question.