Question

A threat hunter is investigating suspected command-and-control activity in a large enterprise. Proxy logs show outbound HTTPS traffic to a newly registered domain from several workstations. The traffic uses valid TLS, occurs during business hours, and the destination is not on any threat feed. However, the hunter notices all sessions to this domain share an identical, uncommon HTTP User-Agent string that does not match any known browser or approved application in the software inventory. What is the MOST effective next step to confirm the hypothesis while minimizing false positives?

Accepted Answer

Pivot on the anomalous User-Agent string across all proxy and endpoint telemetry to identify every host and process generating it, then correlate with process lineage and persistence artifacts.

Answer

Immediately block the destination domain at the proxy and open an incident, since a non-standard User-Agent is definitive proof of malware C2.

Answer

Submit the newly registered domain to a sandbox detonation service and wait for a verdict before taking any further action.

Answer

Tune the SIEM correlation rule to suppress alerts for newly registered domains during business hours to reduce analyst fatigue.