Which technique involves modifying the HTTP user agent field to communicate with a compromised system and to carry forward attacks?

Which technique involves modifying the HTTP user agent field to communicate with a compromised system and to carry forward attacks?

• A. Use of Command-Line Interface
• B. Unspecified Proxy Activities
• C. HTTP User Agent
• D. Use of PowerShell

Answer: (C)

Modifying the HTTP User-Agent field is a way to hide a command and control channel inside normal web traffic. The User-Agent string goes with every HTTP request and is often treated as innocuous by servers and security systems, so attackers can place small commands, identifiers, or signals in that field to tell a compromised host what to do next and to carry forward stages of an attack. This leverages legitimate web communication paths, making the channel harder to spot amid ordinary traffic. It’s different from using a command-line interface, proxy activity, or PowerShell because those methods involve on-device tooling or separate network pathways, whereas this technique repurposes a standard header of HTTP to issue instructions and coordinate actions. In practice, the malware would look for specific User-Agent signals and respond by fetching further payloads or commands from the attacker’s server.

Modifying the HTTP User-Agent field is a way to hide a command and control channel inside normal web traffic. The User-Agent string goes with every HTTP request and is often treated as innocuous by servers and security systems, so attackers can place small commands, identifiers, or signals in that field to tell a compromised host what to do next and to carry forward stages of an attack. This leverages legitimate web communication paths, making the channel harder to spot amid ordinary traffic. It’s different from using a command-line interface, proxy activity, or PowerShell because those methods involve on-device tooling or separate network pathways, whereas this technique repurposes a standard header of HTTP to issue instructions and coordinate actions. In practice, the malware would look for specific User-Agent signals and respond by fetching further payloads or commands from the attacker’s server.