Browser LabLD-SOC2-LAB-004Hard
Browser LabLD-SOC2-LAB-004Hard22 min
Trace a Beacon Across the Wire
A proxy anomaly flagged repeated outbound connections from the finance segment. You have the NetFlow records, the TLS metadata, and the endpoint-to-connection mapping. Find the command-and-control channel and name the host that owns it.
What you will be able to do
- Identify the command-and-control destination from the flow shape.
- Read the TLS metadata that confirms it over its benign twin.
- Correlate the connection back to the owning host and map the technique.
Network AnalysisLog AnalysisT1071.001 — Application Layer Protocol: Web ProtocolsT1573 — Encrypted Channel
Sign in to start this lab.
Sign in