LogQuery & PCAP Forensic Triage – C2 Beacon & Traffic Analysis
Wireshark-driven packet capture triage isolating periodic beacon traffic and extracting indicators of compromise from a suspected C2 channel.
A SIEM alert flagged anomalous periodic outbound connections from workstation 10.10.20.44. The captured PCAP was triaged in Wireshark and tshark to isolate the anomalous flow from background traffic, characterize its beacon cadence, reconstruct the TCP stream, and extract indicators of compromise. The traffic pattern — fixed 60-second interval connections to an unattributed IP with no reverse DNS — is consistent with a lightweight C2 check-in protocol. The host was isolated and the destination blocked at the perimeter within the hour.
- Workstation 10.10.20.44
- SIEM alert #4471, 45-minute capture window
A SIEM alert triggered on periodic outbound connections from a workstation. The captured PCAP was triaged to identify protocol, cadence, and destination reputation of the beaconing traffic, then reconstructed into a full incident timeline.
- Isolate the anomalous flow from background traffic
- Determine beacon interval and jitter
- Reconstruct the TCP stream and extract payload IOCs
- Produce a timeline for the incident report
- 1Filter capture to the suspect host, excluding broadcast/DNS noise
- 2Isolate the repeating outbound flow and measure interval/jitter
- 3Follow and reconstruct the TCP stream in Wireshark
- 4Export objects and extract payload IOCs via tshark
- 5Correlate conversation statistics into an incident timeline
# Filter to suspect host, exclude broadcast noise
$ ip.addr == 10.10.20.44 && !(bootp || arp || dns)
247 packets matched filter (of 18,442 total)
# Isolate repeating outbound TCP flow
$ tcp.flags.syn == 1 && tcp.flags.ack == 0 && ip.dst == 185.220.101.7
41 SYN packets, average interval 60.4s, jitter ±2.1s
# Export objects for payload inspection
$ tshark -r capture.pcap --export-objects http,./extracted
Exported: beacon_payload.bin (312 bytes, base64-encoded body)
# Statistics: conversation timing
$ tshark -r capture.pcap -q -z conv,tcp
10.10.20.44:49213 <-> 185.220.101.7:443 41 pkts duration 41m 23s
Fixed-interval beaconing to unattributed IP
Outbound connection every 60s ± 2s jitter to an IP with no reverse DNS and poor threat-intel reputation.
Base64-obfuscated payload in POST body
Encoded payload consistent with a lightweight C2 check-in protocol, extracted and decoded during triage.
No egress filtering on workstation VLAN
Client subnet permitted unrestricted outbound traffic on all ports, allowing the beacon to reach the internet unimpeded.
| Type | Value | Description |
|---|---|---|
| IPv4 | 185.220.101.7 | C2 beacon destination — no reverse DNS, poor reputation score |
| Beacon Interval | 60s ± 2s | Fixed cadence consistent with a lightweight C2 framework |
| User-Agent | Mozilla/4.0 (compatible; MSIE) | Anomalous legacy UA string used to blend with normal traffic |
- Isolate the host and initiate full forensic imaging
- Block the destination IP/domain at the perimeter firewall
- Implement default-deny egress filtering with explicit allow-listing