A security analyst is performing a forensic analysis on a machine that was the subject of some historic SIEM al

erts. The analyst noticed some network connections utilizing SSL on non-common ports, copies of svchost.exe and cmd.exe in %TEMP% folder, and RDP files that had connected to external IPs. Which of the following threats has the security analyst uncovered?

A. DDoS

B. APT

C. Ransomware

D. Software vulnerability

Explanation: