Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Browser LabLD-SOC2-LAB-004Hard
Browser LabLD-SOC2-LAB-004Hard22 min

Trace a Beacon Across the Wire

A proxy anomaly flagged repeated outbound connections from the finance segment. You have the NetFlow records, the TLS metadata, and the endpoint-to-connection mapping. Find the command-and-control channel and name the host that owns it.

What you will be able to do

  • Identify the command-and-control destination from the flow shape.
  • Read the TLS metadata that confirms it over its benign twin.
  • Correlate the connection back to the owning host and map the technique.
Network AnalysisLog AnalysisT1071.001Application Layer Protocol: Web ProtocolsT1573Encrypted Channel

Sign in to start this lab.

Sign in