Relatively new to the DFIR scene. We have an assumed breach scenario playing out right now and I noticed that there were some GET and POST requests coming from a malignant dll in a users temp directory.

Cool, the strange thing is that the domain the dll is making requests to will be something like cnn.com or businesstrader.com/some-directory/some-file.css

I figured it was getting instructions from a c2 server or maybe writing data to a file remotely somehow but when I follow the links in a secure browser, it just opens up to the actual site.

Can someone help me understand what the threat actor could be doing in this scenario please and thanks?

  • Most likely testing for internet reachability unless those pages can host user-generated content (e.g. comments). Look at the code and you'll know. Oct 8, 2022 at 17:08
  • Twas domain fronting
    – DK36
    Nov 28, 2022 at 22:09


You must log in to answer this question.

Browse other questions tagged .