Network ForensicsSeverity · critical1-day forensic exercise

Packet inspection — hunting a C2 beacon inside noisy egress

Given a pcap-style export from a compromised endpoint, isolated a beaconing session by its jitter pattern and payload footprint, then wrote egress-filter and JA3-fingerprint rules that would have blocked the initial callback.

Evidence · PCAP review · periodic beacon isolatedLIVE

Wireshark · capture-042.pcapngFilter: ip.addr == 199.83.140.14

No.	Time	Source	Destination	Proto	Len	Info
42	0.000	10.4.12.7	199.83.140.14	TLSv1.3	128	Application Data
43	42.031	10.4.12.7	199.83.140.14	TLSv1.3	126	Application Data
44	84.062	10.4.12.7	199.83.140.14	TLSv1.3	128	Application Data
45	126.098	10.4.12.7	199.83.140.14	TLSv1.3	127	Application Data
46	168.121	10.4.12.7	199.83.140.14	TLSv1.3	126	Application Data
47	168.412	10.4.12.7	8.8.8.8	DNS	72	Standard query A

Δt ≈ 42.0s ± 0.03 · payload 126–128B · classic C2 beacon pattern.

Beacon interval

42s ±3s

JA3 matched

Yes

Detection rules added

Re-infections

[01]Objective

Find a low-and-slow command-and-control beacon hidden in normal-looking outbound HTTPS.

[02]Live Lab · C2 beacon hunt lab

Interactive · runs in your browser

01 · Brief
02 · Your move
03 · Result
04 · How I stopped it
05 · How you prevent it

Stage 1 / 5 · Brief

An endpoint is behaving oddly. You have five flows from the last 10 minutes of egress. One is a C2 beacon hidden in TLS traffic.

Look for the pattern real toolkits leak — regular interval, small payload, uninteresting destination that almost looks legit.

[03]Stack · Tools & Platforms

Tools

Wireshark
Zeek
JA3 fingerprints
PowerShell

Platforms

Palo Alto NGFW
Zeek
Windows endpoint

[04]Method

01
Grouped connections by destination + interval; flagged flows with sub-second jitter and consistent small payloads.
Fig · 01 · JA3 match · Cobalt Strike profileLIVE
JA3 fingerprint lookuptls.handshake · client hello
Observed JA3
72a589da586844d7f0818ce684948eea
Observed JA3S
b3d5f9c2ee1af0dc31e8ef4a3ffb1a24
Cipher suite
TLS_AES_128_GCM_SHA256
SNI
cdn-static-updates[.]net
▲ MATCH · malware profile
Cobalt Strike · Malleable C2 profile
(SalesForce / abuse.ch feed · 4,182 seen)
Recommended action
Isolate host WKS-042
Block 199.83.140.14 at perimeter
Add JA3 to Suricata block list
02
Correlated TLS ClientHello fingerprints (JA3) against known toolkits — matched a Cobalt Strike profile.
03
Blocked destination at NGFW; added JA3 hash to detection rules across the fleet.
Fig · 03 · EDR · host isolated in minutesLIVE
Defender for Endpoint · Device WKS-042
ISOLATED· since 14:07:12 UTC
Device
WKS-042
User
a.patel
OS
Windows 11 · 23H2
Risk
HIGH
Response timeline
14:04:00 · Beacon detected (JA3 match)
14:05:22 · Analyst triage started
14:07:12 · Network isolation applied
14:09:40 · Memory dump captured
14:22:04 · Host re-imaged, ticket closed

[05]Outcome

Beacon identified; JA3 fingerprint + destination pushed to blocklist; endpoint re-imaged and monitored.

[06]Lessons learned

Regular interval + tiny payload = beacon, even at TLS. Metadata is enough.
JA3 fingerprints beat IP blocklists because attacker infra rotates faster than lists refresh.

Next case · IAM-014

Entra ID Conditional Access hardening

Open →