It looks like you've outlined an extensive cybersecurity investigation process using Elasticsearch SQL Language (ES|QL) queries to detect and analyze malicious activities within a simulated environment. Let's break down each step of your investigation:
Milestone 1: Identify the Infected Host
Objective: Detect the initial infected host through beaconing activity.
ES|QL Query:
sql1FROM c2-lab-logs 2| WHERE event.dataset == "zeek.conn" 3AND destination.ip IN ("203.0.113.42") 4| STATS COUNT() BY source.ip, source.port, destination.ip, destination.port
What you’re looking for:
- Identify the IP address of the infected host that is communicating with the C2 server (e.g.,
192.168.1.100).
Milestone 2: Confirm Beaconing Behavior
ES|QL Query:
sql1FROM c2-lab-logs 2| WHERE event.dataset == "zeek.conn" 3AND source.ip == "192.168.1.100" 4AND destination.ip == "203.0.113.42 5 6[Read the full article at InfoSec Write-ups - Medium](https://infosecwriteups.com/the-quiet-signal-hunt-forward-lab-001-c2-beaconing-detection-2ac84f976e8a?source=rss----7b722bfd1b8d---4) 7 8--- 9 10**Want to create content about this topic?** [Use Nemati AI tools](https://nemati.ai) to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



