An adversary modifies the content of the HTTP user agent field to communicate with the compromised system and to carry further attacks.

An adversary modifies the content of the HTTP user agent field to communicate with the compromised system and to carry further attacks.

• A. Use of Command-Line Interface
• B. Unspecified Proxy Activities
• C. HTTP User Agent
• D. Use of PowerShell

Answer: (C)

This question tests using a normal HTTP header as a covert communication channel for attacker control. By altering the User-Agent field, an adversary can embed commands or data into regular HTTP traffic. Since every HTTP request carries this header and it’s typically treated as just informational, it becomes a stealthy way to signal with the compromised system and to chain additional actions without drawing obvious attention. That makes the HTTP User-Agent the best match for the described scenario. Other techniques describe different ways to interact with or control a system (for example, interactive command-line interfaces, PowerShell usage, or proxy-based traffic), but they do not capture the idea of abusing the HTTP header itself as a signaling channel for C2 and follow-on attacks.

This question tests using a normal HTTP header as a covert communication channel for attacker control. By altering the User-Agent field, an adversary can embed commands or data into regular HTTP traffic. Since every HTTP request carries this header and it’s typically treated as just informational, it becomes a stealthy way to signal with the compromised system and to chain additional actions without drawing obvious attention. That makes the HTTP User-Agent the best match for the described scenario.

Other techniques describe different ways to interact with or control a system (for example, interactive command-line interfaces, PowerShell usage, or proxy-based traffic), but they do not capture the idea of abusing the HTTP header itself as a signaling channel for C2 and follow-on attacks.