CAS-003 · Question #543
A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the…
The correct answer is B. An outside command and control system is attempting to reach an infected system. Repeated 'call home' messages at the network boundary are a well-known indicator of command and control (C2) traffic, where external attacker infrastructure attempts to communicate with malware already installed on an internal company system.
Question
A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the massages. After determining the alert was a true positive, which of the following represents OST likely cause?
Options
- AAttackers are running reconnaissance on company resources.
- BAn outside command and control system is attempting to reach an infected system.
- CAn insider trying to exfiltrate information to a remote network.
- DMalware is running on a company system
How the community answered
(41 responses)- A2% (1)
- B83% (34)
- C5% (2)
- D10% (4)
Why each option
Repeated 'call home' messages at the network boundary are a well-known indicator of command and control (C2) traffic, where external attacker infrastructure attempts to communicate with malware already installed on an internal company system.
Reconnaissance involves scanning, probing, or enumeration to gather information about targets, producing different network signatures such as port scans or DNS queries - not the repetitive structured beacon pattern characteristic of 'call home' C2 traffic.
The term 'call home' in network security specifically describes the beaconing behavior of malware that periodically contacts an external C2 server to receive instructions or report status. The continuous nature of these messages at the network boundary, combined with the proxy firewall successfully dropping them, is consistent with an active C2 channel being blocked - indicating an infected internal host is attempting to maintain communication with attacker-controlled external infrastructure.
Insider exfiltration involves outbound transfers of sensitive files or data, which would produce large upload flows or unusual data patterns - not the low-bandwidth, repetitive 'call home' beacon messages associated with C2 communication.
While malware running on a company system is implied by the scenario, this answer does not address the specific network behavior being observed; option B more precisely identifies the mechanism of external C2 communication that explains why 'call home' messages appear at the network boundary.
Concept tested: Command and control C2 call home traffic detection and identification
Source: https://attack.mitre.org/tactics/TA0011/
Topics
Community Discussion
No community discussion yet for this question.