JFR Sec
--:--:--
Back to catalog
Traffic AnalysisCVSS 8.6 · Critical

LogQuery & PCAP Forensic Triage – C2 Beacon & Traffic Analysis

Wireshark-driven packet capture triage isolating periodic beacon traffic and extracting indicators of compromise from a suspected C2 channel.

2025-07-221 day
WiresharkPCAPTraffic AnalysisIDS
[ VIEW REPO]
Executive Summary

A SIEM alert flagged anomalous periodic outbound connections from workstation 10.10.20.44. The captured PCAP was triaged in Wireshark and tshark to isolate the anomalous flow from background traffic, characterize its beacon cadence, reconstruct the TCP stream, and extract indicators of compromise. The traffic pattern — fixed 60-second interval connections to an unattributed IP with no reverse DNS — is consistent with a lightweight C2 check-in protocol. The host was isolated and the destination blocked at the perimeter within the hour.

Scope
  • Workstation 10.10.20.44
  • SIEM alert #4471, 45-minute capture window
Overview

A SIEM alert triggered on periodic outbound connections from a workstation. The captured PCAP was triaged to identify protocol, cadence, and destination reputation of the beaconing traffic, then reconstructed into a full incident timeline.

Objectives
  • Isolate the anomalous flow from background traffic
  • Determine beacon interval and jitter
  • Reconstruct the TCP stream and extract payload IOCs
  • Produce a timeline for the incident report
Methodology
  1. 1Filter capture to the suspect host, excluding broadcast/DNS noise
  2. 2Isolate the repeating outbound flow and measure interval/jitter
  3. 3Follow and reconstruct the TCP stream in Wireshark
  4. 4Export objects and extract payload IOCs via tshark
  5. 5Correlate conversation statistics into an incident timeline
Command Log
session_log.sh

# Filter to suspect host, exclude broadcast noise

$ ip.addr == 10.10.20.44 && !(bootp || arp || dns)

247 packets matched filter (of 18,442 total)

# Isolate repeating outbound TCP flow

$ tcp.flags.syn == 1 && tcp.flags.ack == 0 && ip.dst == 185.220.101.7

41 SYN packets, average interval 60.4s, jitter ±2.1s

# Export objects for payload inspection

$ tshark -r capture.pcap --export-objects http,./extracted

Exported: beacon_payload.bin (312 bytes, base64-encoded body)

# Statistics: conversation timing

$ tshark -r capture.pcap -q -z conv,tcp

10.10.20.44:49213 <-> 185.220.101.7:443   41 pkts   duration 41m 23s
Findings

Fixed-interval beaconing to unattributed IP

Outbound connection every 60s ± 2s jitter to an IP with no reverse DNS and poor threat-intel reputation.

Critical

Base64-obfuscated payload in POST body

Encoded payload consistent with a lightweight C2 check-in protocol, extracted and decoded during triage.

Critical

No egress filtering on workstation VLAN

Client subnet permitted unrestricted outbound traffic on all ports, allowing the beacon to reach the internet unimpeded.

High
Indicators of Compromise
TypeValueDescription
IPv4185.220.101.7C2 beacon destination — no reverse DNS, poor reputation score
Beacon Interval60s ± 2sFixed cadence consistent with a lightweight C2 framework
User-AgentMozilla/4.0 (compatible; MSIE)Anomalous legacy UA string used to blend with normal traffic
Remediation
  • Isolate the host and initiate full forensic imaging
  • Block the destination IP/domain at the perimeter firewall
  • Implement default-deny egress filtering with explicit allow-listing