An analyst is alerted for a malicious file hash. After analysis, the analyst determined that an internal workstation is communicating over port 80 with an external server and that the file hash is associated with Duqu malware. Which tactics, techniques, and procedures align with this analysis?
A) Command and Control, Application Layer Protocol, Duqu
B) Discovery, Remote Services: SMB/Windows Admin Shares, Duqu
C) Lateral Movement, Remote Services: SMB/Windows Admin Shares, Duqu
D) Discovery, System Network Configuration Discovery, Duqu

Question

Quizplus · Accepted Answer

The communication over port 80 with an external server suggests a Command and Control tactic using an Application Layer Protocol, which aligns with the behavior of Duqu malware.

An Analyst Is Alerted for a Malicious File Hash