Question

A security analyst reviewing telemetry notices that a compromised internal workstation is sending large, encrypted POST requests to an external host on TCP port 443 at regular intervals throughout the night. The destination domain was registered only days ago and receives far more upload traffic from the host than it returns. Which data exfiltration technique does this activity most strongly indicate?

Accepted Answer

HTTPS-based exfiltration, where stolen data is hidden inside encrypted web traffic to blend with normal outbound browsing

Answer

DNS tunneling, where data is encoded into subdomain queries sent to an attacker-controlled name server

Answer

ICMP tunneling, where payload data is embedded in the data field of echo request packets

Answer

NTP-based exfiltration, where data is smuggled inside time synchronization requests