Lire en françaisع
Menu

Back to the Academy

CLR-5 · Hands-on lab · Hardcore ·about 35 min

Threat hunting: the steady heartbeat

No alert fired. Hunt through a day of DNS queries to find a host that phones home on a perfect timer, identify its command-and-control domain, measure the interval, and decode the data it hides in the subdomain.

Briefing

No alert fired. That is exactly when hunting matters: you form a hypothesis and go looking in the data for something no rule caught yet.

Your hypothesis today: a host on the Finance subnet (192.0.2.0/24) is beaconing — a piece of malware that contacts its command-and-control (C2) server at a regular interval to ask for orders. The tell is the rhythm. A person browsing the web produces bursts: many queries, then nothing, then a few more. A beacon is a metronome: one query, wait, one query, wait, forever.

You have dns.csv, a full day of DNS queries from the internal resolver:

time,src_ip,query,qtype

Work it in four steps:

  1. Find the talker: which host queries far more than the others?
  2. Find the C2: which domain does it keep reaching, under ever-changing subdomains?
  3. Measure the beat: what is the interval between beacons?
  4. Read the payload: tunnelling malware hides data in the subdomain. Decode the first beacon.

cut, sort | uniq -c, grep and base64 -d are all you need. Everything is simulated: reserved domains, documentation IP ranges, a fake flag.

Terminal

Type help to list the commands. Tab completes, ↑ ↓ browse the history.

Questions

  1. One internal host sends far more DNS queries than any other, all day, like clockwork. Which host (IP) is it?25 XP

    1. That host keeps querying subdomains of one registered domain. What is that command-and-control domain (the last two labels, like example.com)?25 XP

      1. The queries to that domain arrive at a fixed spacing: that is what makes it a beacon. How many seconds pass between two consecutive beacons?25 XP

        1. The first beacon of the run is a registration message: it carries data in its left-most subdomain label, base64-encoded. Decode it. What flag does it contain (ZEN{...})?25 XP