The Quiet Signal - Hunt Forward Lab #001: C2 Beaconing Detection

It looks like you've outlined an extensive cybersecurity investigation process using Elasticsearch SQL Language (ES|QL) queries to detect and analyze malicious activities within a simulated environment. Let's break down each step of your investigation:

Milestone 1: Identify the Infected Host

Objective: Detect the initial infected host through beaconing activity.

ES|QL Query:

sql
 
1FROM c2-lab-logs
2| WHERE event.dataset == "zeek.conn"
3AND destination.ip IN ("203.0.113.42")
4| STATS COUNT() BY source.ip, source.port, destination.ip, destination.port

What you’re looking for:

• Identify the IP address of the infected host that is communicating with the C2 server (e.g., 192.168.1.100).

Milestone 2: Confirm Beaconing Behavior

ES|QL Query:

sql
 
1FROM c2-lab-logs
2| WHERE event.dataset == "zeek.conn"
3AND source.ip == "192.168.1.100"
4AND destination.ip == "203.0.113.42
5
6[Read the full article at InfoSec Write-ups - Medium](https://infosecwriteups.com/the-quiet-signal-hunt-forward-lab-001-c2-beaconing-detection-2ac84f976e8a?source=rss----7b722bfd1b8d---4)
7
8---
9
10**Want to create content about this topic?** [Use Nemati AI tools](https://nemati.ai) to generate articles, social posts, and more.