CND (312-38) Network Defense Simulation

Practice identifying endpoint malware capabilities through network traffic analysis. Learn how malicious software captures sensitive user input before exfiltrating it across the network.

Network Scenario

You are monitoring an enterprise network as a Tier 2 SOC Analyst. The Intrusion Detection System (IDS) alerts on a continuous pattern of suspicious outbound HTTP POST requests originating from a workstation in the Finance department (IP: 10.10.50.23).

The host is attempting to communicate with an unclassified external domain. Upon isolation and initial endpoint triage, the incident response team discovers a malicious hidden driver hooked into the operating system's keyboard stack. The malware appears to be intercepting user input locally, encrypting it, and transmitting the stored buffers via the network.

Traffic & Logs

[**] [1:2018317:3] ET MALWARE Suspicious POST Payload (Data Exfiltration) [**]
Classification: A Network Trojan was detected
Priority: 1
10/24/2023-14:22:10.103422 10.10.50.23:49152 -> 198.51.100.45:80

POST /api/v1/sync HTTP/1.1
Host: login-update-service.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Length: 184
Content-Type: application/x-www-form-urlencoded

--- DECODED PAYLOAD EXTRACT ---
[14:15:00] [firefox.exe] Title: Chase Bank Login
[14:15:05] jsmith@company.com[TAB]
[14:15:12] P@ssw0rd2023![ENTER]
-------------------------------

Question

Which of the following can be performed with software or hardware devices in order to record everything a person types using his or her keyboard?

Defensive Hint: Look at the "DECODED PAYLOAD EXTRACT" in the logs. It shows exactly what the user typed, including special keys like [TAB] and [ENTER]. What is the specific term for capturing this mechanical input?

1. What is happening in the network

An endpoint in the Finance department has been compromised. A malicious payload is actively hooking into the system's input stack, capturing raw keystrokes (including credentials and application context), logging them locally, and periodically beaconing this data out to an external Command and Control (C2) server via HTTP POST requests.

2. Identify attack or behavior

This is a classic Credential Harvesting / Data Exfiltration attack utilizing a Keylogger. The malware acts locally on the endpoint but manifests on the network as periodic, small-burst exfiltration traffic.

3. Why correct answer is correct

B. Keystroke logging is the correct answer because it specifically defines the process of intercepting and recording user keyboard input. This can be achieved via software (API hooking, kernel drivers) or hardware (physical USB pass-through devices).

4. Why others are wrong

A. Warchalking: This is a physical security term referring to drawing symbols in public spaces to indicate the presence of open Wi-Fi networks. It does not record keystrokes.
C. War dialing: An older technique involving dialing thousands of phone numbers to locate active modems or PBX systems. It relates to telephony/perimeter scanning, not endpoint input capture.
D. IRC bot: While an IRC botnet might deploy a keylogger as a module, the bot itself is an automated script/program used for receiving commands or launching DDoS attacks, not the mechanism of recording keys itself.

5. Defensive action

Containment: Immediately isolate 10.10.50.23 from the network to prevent further credential theft.
Mitigation: Add 198.51.100.45 and login-update-service.com to the firewall and web proxy blocklists.
Remediation: Force a mandatory password reset for the affected user ("jsmith") across all internal and external services.
Prevention: Deploy advanced EDR (Endpoint Detection and Response) solutions that use behavioral analysis to detect unauthorized API hooking, rather than relying solely on signature-based AV.

6. MINI LESSON: Keyloggers in Network Defense

Traffic Pattern Recognition: Keyloggers rarely send data instantly. To avoid detection, they store data locally and "burst" transmit it (e.g., every 5 minutes or when a file reaches 50KB). Defenders should look for repetitive, low-volume beaconing to unknown domains.
Protocol Behavior: Attackers often use standard protocols like HTTP/HTTPS (port 80/443) or DNS to blend in with normal web traffic. Deep Packet Inspection (DPI) or SSL decryption is required to analyze the payload contents.
Defense-in-Depth: Since hardware keyloggers bypass software AV entirely, endpoint port security (disabling rogue USB devices via Group Policy) is a critical defensive layer.

Ready to master Network Defense?

Explore more CND simulations