IDLE

Threat Hunting: C2 Beaconing

Name: Threat Hunting: C2 Beaconing
Brand: Hacker Labs

INSTANCE: hl-attackthreathu · IP: 10.10.24.34 · ap-south-1

TIME02:30:00

Kali Linux

Lab not running

Click Launch above to provision a fresh Kali Linux VM. Takes ~30s.

Submit flag

0/4 objectives

Scenario

Hunt T1071 application-layer beaconing across Splunk, Sysmon and DNS logs.

Objectives — click to toggle

Step-by-step walkthrough

1
Hypothesis
Write a hunting hypothesis: 'A compromised host on 10.10.20.0/24 is beaconing every 30-60s to a low-rep domain.'
2
Baseline
Compute mean inter-arrival per destination over 24h in Zeek conn logs.
```
index=zeek sourcetype=conn | stats avg(duration) p95(duration) by id.resp_h
```
3
Find jitter
Look for destinations with stddev < 5s and >100 connections — classic beacon.
4
Pivot
Take suspect IP → Sysmon EID 3 to find the process making the connection.
5
Report
Document host, process, parent, hashes, IOC list, kill chain mapping.

Submission requirements

Upload deliverables via the Files tab before claiming points.