In the sample honeypot log, which event indicates an FTP password retrieval attempt?

In the sample honeypot log, which event indicates an FTP password retrieval attempt?

• A. spp_portscan
• B. IDS277/DNS-version-query
• C. IDS213/ftp-passwd-retrieval
• D. IDS/RPC-rpcinfo-query

Answer: (C)

The key idea is to identify the action that explicitly targets credentials in the honeypot log. An FTP password retrieval attempt is indicated by the event labeled ftp-passwd-retrieval. This event name directly describes trying to fetch the FTP password file, which is a classic credential-recovery/credential-theft activity seen in attack patterns. In contrast, the other events map to different kinds of activity: a port scan shows someone probing for open ports, a DNS version query requests the version information of the DNS server, and an RPC information query seeks details about RPC services. None of these describe retrieving password data via FTP, so they don’t match the described malicious action. So, the ftp-passwd-retrieval event is the correct signal because its label explicitly denotes an attempt to obtain password information through FTP.

The key idea is to identify the action that explicitly targets credentials in the honeypot log. An FTP password retrieval attempt is indicated by the event labeled ftp-passwd-retrieval. This event name directly describes trying to fetch the FTP password file, which is a classic credential-recovery/credential-theft activity seen in attack patterns.

In contrast, the other events map to different kinds of activity: a port scan shows someone probing for open ports, a DNS version query requests the version information of the DNS server, and an RPC information query seeks details about RPC services. None of these describe retrieving password data via FTP, so they don’t match the described malicious action.

So, the ftp-passwd-retrieval event is the correct signal because its label explicitly denotes an attempt to obtain password information through FTP.