Lesson 1.67: Finding beacons in encrypted traffic
Most malware phones home: at regular intervals it connects to its command-and-control (C2) server to ask for instructions. The content is encrypted, but the rhythm isn't: the same small connection to the same address every few minutes, day and night, with a little random jitter. TLS metadata often adds more: a self-signed certificate or an odd server name. In the lab you measure the intervals of fin-ws07's connections, confirm the C2 through Zeek's ssl.log and dns.log, and write the indicators of compromise for the incident.
16 min
You will learn to
- Explain beaconing and C2
- Measure connection intervals with awk
- Use TLS metadata (SNI, certificate validation)
- Link DNS answers to connections
- Record indicators of compromise
Key terms
- Command and control (C2)
- The server and channel an attacker uses to direct compromised machines.
- Beacon
- A regular check-in from malware to its C2.
- Jitter
- Random variation added to the interval to look less regular.
- SNI (Server Name Indication)
- The server name a TLS client sends in the clear at the start of the handshake.
- Self-signed certificate
- A certificate not issued by a trusted authority.
- IOC (indicator of compromise)
- An observable such as an IP, domain or hash that points to an intrusion.
← Network devices: network cards, switches, routers and access points · All lessons · The Windows security model →