hard20 pts · first answer countsnetwork-securityzeekthreat-hunting
A connection open for 30 hours
Zeek conn.log shows a workstation with a TCP connection to an unknown cloud IP lasting 30 hours, with small, steady byte counts both ways. Why hunt this?
Discussion 0
Join free to post in the discussion.
Related questions
- IDS vs IPSCybersecurity Analyst
- What makes a firewall stateful?Cybersecurity Analyst
- Threat hunting versus alertingCybersecurity Analyst
- Many discovery commands in a minuteCybersecurity Analyst
- Why build a baseline firstCybersecurity Analyst
- The hidden last rule of a firewallCybersecurity Analyst
- Default port for SSHCybersecurity Analyst
- RDP open to the internetCybersecurity Analyst