What indicates a successful C2 communication detection using endpoint logs? (Choose two)

Question

Options

• AIncreased outbound traffic to unknown IPs
• BFrequent system reboots
• CUnusual process tree formations
• DHigh volume of encrypted data sent to known ports

• A
  80% (20)
• B
  8% (2)
• D
  12% (3)

Explanation

A (Increased outbound traffic to unknown IPs) and C (Unusual process tree formations) are correct because both are classic behavioral indicators visible in endpoint logs. C2 implants beacon out to attacker-controlled infrastructure (unknown IPs), creating anomalous outbound connection patterns. Unusual process trees - such as Word.exe spawning cmd.exe or powershell.exe - reveal post-exploitation activity where a C2 payload has injected into or launched unexpected child processes.

B is wrong because frequent reboots are more indicative of ransomware, unstable malware, or hardware issues - not C2 communication, which typically favors persistence and stealth over disruption.

D is wrong because legitimate encrypted traffic (HTTPS on port 443, for example) routinely sends high volumes to known ports. C2 traffic is suspicious precisely because it goes to unknown or unexpected destinations, not because of the port or volume alone.

Memory tip: Think "WHO and HOW" - C2 detection is about who the endpoint is talking to (unknown IPs → A) and how processes behave after infection (weird parent-child relationships → C). Reboots and encryption on known ports are noise.

No community discussion yet for this question.