Cisco 200-201 Online Access

 The communication channel established from a compromised machine back to the attacker is known as a command and control (C2) channel. This channel allows attackers to maintain communication with the compromised system, issue commands, and potentially exfiltrate data. The C2 channel can be established using various protocols and methods to evade detection and maintain persistence.

The log in the exhibit is generated by a firewall. It shows a deny action taken on TCP traffic, specifying the source and destination addresses and ports, which is characteristic of firewall logs. Firewalls are designed to control incoming and outgoing network traffic based on predetermined security rules, and this log entry reflects the enforcement of such a rule.

References :=

• Cisco’s official documentation on firewall technologies and their log formats.

This event category is exploitation because the HTTP requests contain PHP code that attempts to execute commands on the web server and create a backdoor. Exploitation is the phase of the attack where the threat actor gains access to the target system and executes malicious code. References: (Module 2, Lesson 2.1.3)

The regular expression c(rgr)+e matches strings where “rgr” occurs one or more times between “c” and “e”. The string “crgrrgre” fits this pattern as it has the sequence “rgr” repeated twice between “c” and “e”. The plus sign (+) in the regular expression indicates that the preceding element must appear one or more times for a match to occur