After completing a review of network activity, the threat hunting team discovers a device on the network that sends an outbound email via a mail client to a non-company email address daily at 10:00…

Question

Options

• AIrregular peer-to-peer communication
• BRogue device on the network
• CAbnormal OS process behavior
• DData exfiltration

• A
  12% (6)
• B
  4% (2)
• C
  2% (1)
• D
  82% (41)

Explanation

Data Exfiltration via Scheduled Email

Sending an outbound email to a non-company address on a regular, scheduled basis (daily at 10:00 p.m.) is a classic indicator of data exfiltration - where sensitive information is being covertly transmitted outside the organization, often automated to avoid detection during off-hours. This pattern suggests someone or something is deliberately and systematically moving data out of the network.

Why the distractors are wrong:

• A (Irregular peer-to-peer communication): P2P involves direct device-to-device communication within or between networks, not outbound email to an external address.
• B (Rogue device): A rogue device is an unauthorized device on the network; the question doesn't indicate the device itself is unauthorized, only that its behavior is suspicious.
• C (Abnormal OS process behavior): This would refer to unusual processes running on the operating system (e.g., unexpected services), not outbound email activity.

Memory Tip: Think "scheduled + external + sensitive channel = Exfiltration." Whenever you see regular, automated communication going outside the organization, especially during off-hours, think data exfiltration - attackers love using legitimate tools (like email) to blend in and steal data undetected.

No community discussion yet for this question.