Hunting command-and-control traffic: beacons, tunnels, exfiltration
You hunt regular beacons, long connections, DNS tunnels and unusual data egress with statistics and report findings with evidence.
Level 401 · 14 lessons · 12 practice labs
Lessons
The hunting approach
- Hypothesis-driven hunting: asking the right question
- Common behaviours of command-and-control channels
- Preparing data to hunt: Zeek, flow and proxy logs
- Short task: write three hunting hypotheses and the data each needs
Beacons and long connections
- Beacon periodicity: interval distribution and deviation
- Catching beacons with added jitter
- Long-lived connections and low-volume persistent sessions
- Rare destinations: addresses only one or two hosts talk to
- Short task: find the host calling out every 60 seconds plus or minus 20 percent
Tunnels and exfiltration
- Hunting DNS tunnels by subdomain length and entropy
- Traces of tunnels over ICMP and HTTP
- Detecting exfiltration from sent-to-received byte ratios
- Turning a hunt finding into a permanent detection
- Capstone: find and report two hidden command channels in a week of logs
Practice labs
- Write a hunt hypothesis: Write one testable hunt hypothesis and its required data source from a given threat note.
- Three hypotheses and the data they need: Write one hypothesis each for beaconing, tunnelling and exfiltration and match each to Zeek, flow or proxy logs.
- Prepare the hunt data: Bring Zeek, flow and proxy logs to a common time zone and host naming so one query can read them.
- Measure connection intervals: List the gaps between one host's connections to the same destination and take the mean.
- Sixty seconds plus or minus twenty percent: Find the host connecting at 60-second intervals with 20 percent jitter in prepared logs.
- Catch a jittered beacon with a score: Produce a score from interval distribution and data size consistency and rank the top three pairs with reasons.
- List the long-running connections: List outbound connections lasting over an hour with duration and bytes.
- Destinations only one or two hosts talk to: Count the external destinations reached by the fewest hosts and produce the top twenty.
- The low-volume persistent session: Find the session lasting days yet carrying very little data and explain how it differs from legitimate update traffic.
- The ratio of bytes sent to received: List the hosts whose outbound data exceeds ten times what they received.
- Hunt a DNS tunnel with entropy: Score queries by subdomain length and entropy and find the tunnel domain.
- Find two hidden channels and turn them into detections: Find two command channels in a week of prepared Sedirli Hukuk Bürosu logs and propose a lasting detection rule for each.
About this course
You hunt regular beacons, long connections, DNS tunnels and unusual data egress with statistics and report findings with evidence.
What you will learn
- The hunting approach
- Beacons and long connections
- Tunnels and exfiltration
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.