Network threat hunting: beaconing, DNS, unusual flows
You hunt command-and-control traffic, DNS tunnels and data exfiltration hiding in flow, DNS and TLS records, using statistics and intuition.
Level 301 · 15 lessons · 15 practice labs
Lessons
Command and control
- Traits of C2 traffic
- Beacon analysis: interval, jitter, data size
- Writing a script to score beacons
- Short task: find a beacon with random jitter
DNS
- DNS baselines: the most queried and the rare domains
- DNS tunnelling: long subdomains and TXT traffic
- Algorithmically generated domains
- Traffic to newly registered domains
- Short task: reconstruct a file exfiltrated over DNS
Flows and exfiltration
- Data volume outliers
- Unusual ports and protocols
- Traces of internal scanning and discovery
- Hunting in TLS: SNI, certificates, fingerprints
- Short task: explain the large out-of-hours uploads or open an incident
Capstone
- Capstone: find every channel the attacker used in a week of network data
Practice labs
- Find the host calling out every 60 seconds: Find the source connecting to the same destination at equal intervals in the connection records and calculate the interval.
- Catch a beacon with random jitter using statistics: Calculate the mean and deviation of connection intervals and find the pair with low variability.
- Write a script that scores beacon candidates: Write a script scoring by interval regularity, data size and connection count and list the top five candidates.
- Separate hidden C2 from update traffic: Eliminate legitimate periodic update checks and prove the one suspicious destination that remains.
- Find the host querying the longest subdomains: Calculate query length in DNS records and show the source repeatedly asking for very long names.
- Reassemble a file exfiltrated over DNS: Join the encoded subdomains in order, decode them and find the secret value inside the file.
- Pick out algorithmically generated domains: Rank queried names by randomness and NXDOMAIN rate and find the host generating them.
- Validate traffic to a newly registered domain in context: Match queries with the registration date list, examine the connections that follow and single out the malicious one.
- Find the host receiving commands through TXT records: Find an unusual volume of TXT queries and decode the encoded commands in the answers.
- Find the host sending the most data out of hours: Filter flows by hour, sum outbound bytes and note the top night-time sender.
- Find the host scanning the internal network from flows: Find the source connecting to many distinct targets and ports in a short time and state the scan type.
- Find the unusual port and protocol pairing: Pick out flows carrying an unexpected protocol on well-known ports and explain the large TCP transfer on port 53.
- Explain the large night-time upload or open an incident: Compare the transfer with the backup schedule and the destination’s owner and write your decision with evidence.
- Find the host asking one domain for the most subdomains: In a day of DNS records find the internal host that queries the most distinct subdomains under one parent domain and state the count.
- List the least-seen destination ports: Count destination ports in a day of flow records and name the ports only one internal host uses.
About this course
You hunt command-and-control traffic, DNS tunnels and data exfiltration hiding in flow, DNS and TLS records, using statistics and intuition.
What you will learn
- Command and control
- DNS
- Flows and exfiltration
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.