Browser LabLD-TH-LAB-003Hard
Browser LabLD-TH-LAB-003Hard32 min
Trace the Qasr Beacon
A threat-informed hunt looks for C2 beaconing on Qasr's network. You have aggregated outbound connection data and authentication logs. Separate real beaconing from legitimate periodic traffic, then pivot to establish the full scope response will need.
What you will be able to do
- Identify true beaconing versus legitimate periodic traffic.
- Pivot from the C2 indicator to all affected hosts.
- Establish the containment scope from evidence.
Threat HuntingNetwork AnalysisWindows SecurityT1071 — Application Layer ProtocolT1021 — Remote Services
Sign in to start this lab.
Sign in