Nightly 45 MB Upload from a Finance Workstation
At 09:00 a NetFlow review shows workstation 10.20.14.37, used by a finance analyst on Windows 10, sent 42–48 MB outbound to 198.51.100.23:443 every night between 02:10 and 02:25 for the past six days. The destination is a hosting provider in another country, and the TLS certificate is self-signed with CN=sync-update-cdn. Proxy logs show the same host resolving sync-update-cdn[.]com, registered 11 days ago, with a different IP each day. The analyst says she installed a free PDF converter two weeks ago. NetFlow retention is 7 days, full PCAP is captured only on the DMZ span, proxy logs are kept 30 days, and EDR shows no alerts on the host. The workstation is on the same VLAN as 40 other finance users. The CISO asks whether to isolate the host now or wait for more evidence, and whether this could be sanctioned cloud backup.
1. Assess whether this traffic is consistent with sanctioned cloud backup or with exfiltration. What evidence would raise or lower your confidence?
Read the worked answer
Verdict: not a sanctioned backup. Sanctioned cloud backup normally shows a stable vendor domain, documented schedule, consistent egress IP ranges, and a certificate chain from a public CA. Here the domain is 11 days old, resolves to a different IP daily, uses a self-signed certificate, and the transfer is a fixed 42–48 MB nightly window from one finance workstation. That pattern, a beacon followed by fixed-size upload, is more consistent with C2 and staged collection than with backup software. The user-installed PDF converter is a plausible initial infection vector.
But do not decide on reputation alone. Confirm the process: check EDR process tree for the executable that owns the connection, prefetch and Amcache for the converter, and the proxy user-agent. Ask the user and check the software inventory. A self-signed certificate is suspicious but not conclusive; some internal tools use them. The rotating IP and newly registered domain are the strongest signals.
Confidence: moderate-to-high for malicious; enough to isolate, not enough to publicly attribute or wipe.
2. Given the retention constraints, lay out your evidence-collection order and explain why. What should not be done?
Read the worked answer
Collection order: volatile network evidence first, because NetFlow expires in 7 days. 1) Export and hash the 7 days of NetFlow records for 10.20.14.37 and 198.51.100.23. 2) Mirror the workstation switch port or use EDR live response to capture current connections, DNS cache, and ARP before isolation changes state. 3) Pull proxy logs for the domain across all users, not just this host, to test scope. 4) Capture a memory image; the implant may live only in memory and the machine may be rebooted. 5) Only then image the disk.
Do not power off. Pulling the plug destroys memory-resident evidence and encryption keys. Use EDR network containment, which keeps the agent and memory intact while blocking egress. Preserve chain of custody: record who captured what, when, and the hash.
Scope check: search proxy and DNS logs for sync-update-cdn[.]com and the resolved IPs across the estate; a single host is rarely the only one.
3. The CISO wants a containment decision: isolate now or wait. Recommend an action, scope it, and state what would change your mind.
Read the worked answer
Isolate now, but preserve first. The 42–48 MB nightly upload is active exfiltration, and every additional night adds loss. Waiting for more evidence has a cost measured in data. The decision is not whether to contain but how: EDR network containment rather than shutdown, block the destination IP and domain at the egress firewall, and disable the user's VPN session. Do not delete the PDF converter yet.
Scope: the workstation shares a VLAN with 40 finance users, so check for lateral movement: SMB connections from 10.20.14.37, new logons, and the same domain in proxy logs. Reset the analyst's credentials from a clean device, revoke VPN tokens, and check mailbox rules for forwarding.
What would change my mind: if the destination were a known, IT-approved backup provider with a documented schedule and a public certificate, I would downgrade to a policy violation and investigate data-handling rather than declare an incident. The evidence does not support that. Notify legal and privacy if finance data left; the volume suggests targeted collection.