[Handling and Responding to Malware Incidents] Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system. Which of the following recon attacks is the MOST LIKELY to provide this information?

The malware's objective is to identify "useful services" running on the compromised system. Network services (e.g., HTTP, FTP, SSH) listen for incoming connections on specific network ports. A port scan is a reconnaissance technique designed specifically to probe a target host to discover which ports are open and, by extension, which services are active and listening. This method provides the most direct and comprehensive information to fulfill the malware's goal of mapping available services for potential further exploitation or data exfiltration.

A. IP range sweep: This technique identifies active hosts on a network but does not provide information about the specific services running on them.
B. Packet sniffing: This is a passive method of capturing traffic. It can only identify services that are currently communicating, not all available services.
C. Session hijack: This is an attack to take over an existing, authenticated user session, not a method for discovering network services.

1. National Institute of Standards and Technology (NIST). (2008). Technical Guide to Information Security Testing and Assessment (NIST Special Publication 800-115).

Section 4.3.1

"Network Port and Service Identification

" Page 4-10: "Port scanning is the process of connecting to TCP and UDP ports on a target system to determine what services are running or in a listening state... The basic port scanning process involves sending a message to each port

one at a time

and analyzing the response." This directly aligns with the malware's goal.

2. Saltzman

R. M. (2017). Lecture 15: Network Security. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Slide 10

"Port scanning": The lecture notes explicitly state the goal of port scanning is to "Find out what services are running on a machine" by attempting to connect to a range of TCP/UDP ports.

3. Hutchins

E. M.

Cloppert

M. J.

& Amin

R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation.

Page 6

"Reconnaissance": While the question places the malware post-exploitation

the action itself is a form of internal reconnaissance. The paper describes how adversaries

once inside

"conduct internal reconnaissance to map the network and identify high-value targets." Port scanning is a fundamental technique for this internal mapping of services.