Question

A SOC analyst reviews output from a predictive AI engine that models traffic patterns across the enterprise. The engine flags a sequence beginning with a single external host sending sequential TCP SYN packets to thousands of ports on multiple internal hosts, followed by targeted connection attempts to only the small subset of ports that responded. No authentication attempts or data transfers have occurred yet. Based on this sequence, what phase of the attack is the AI most likely indicating, and what should the analyst prioritize?

Accepted Answer

Reconnaissance/scanning — prioritize identifying the source, enriching it against threat intel, and tightening perimeter filtering before the attacker moves to exploitation

Answer

Data exfiltration — prioritize blocking outbound traffic and preserving egress logs for forensic review

Answer

Lateral movement — prioritize isolating internal hosts that are pivoting between segments

Answer

Command and control — prioritize sinkholing the beaconing domains and terminating persistent sessions