Beaconing Engineers and a Domain Controller

Implement default-deny egress with a documented allowlist, enforced at the perimeter firewall, and remove the direct-to-IP exemption so all 443 traffic traverses the proxy. This wins on coverage, time, and measurability.

• Versus DNS filtering alone: the beacons are direct-to-IP, so DNS never sees them; the adversary can also use DoH. DNS filtering would look busy and miss the actual traffic.
• Versus full TLS inspection: certificate pinning in engineering tools breaks, you need an internal CA rollout across 400 devices, and inspection will not help with sessions that carry no SNI. It also raises privacy and legal review that will not finish in two weeks.
• Versus IP blocking alone: the two addresses are disposable; blocking them produces a metric but no durable control.

With deny-by-default, the beacon dies at the first rule push, and every blocked flow becomes a detection source. Combined with JA3 fingerprinting on the firewall, you get the measurable signal the CISO asked for: count of hosts matching the malicious JA3 per day, and count of denied direct-to-IP 443 attempts per host. Build the allowlist from 30 days of proxy logs plus vendor confirmation so business traffic is not broken.

Aggregate NetFlow in one-hour buckets per source/destination pair and flag combinations meeting all of:

• session count to the same destination above 30 per hour;
• median bytes per session below 5 KB outbound and below 10 KB inbound (small command-and-control payloads);
• standard deviation of inter-session interval under 10 seconds (machine timing, not human);
• traffic present in at least one overnight window with no corresponding interactive logon on the host.

Then add two enrichment pivots: join against a JA3/JA3S watchlist on the firewall, and join destination IPs against ASN reputation - 185.199.108.0/24 is a content-hosting range, which is unusual for a licence server.

Order the output by destination and by host criticality, not by volume. A single low-volume beacon from DC-02 outranks hundreds of blocked flows from an engineering laptop. Include a suppression list of known-good polling agents (AV, patch management, monitoring) built from the proxy logs before enabling the rule, or the queue will be unusable on day one.

Validation, in order of evidentiary weight:

• Ask for the vendor name, contract, and the exact hostname the tool contacts, then search DNS and proxy logs for it. A licence check normally resolves a vendor domain and holds a stable session; it does not connect to bare content-hosting IPs.
• Compare the beacon on ENG-WS-014 with a machine that does not run the tool. If the interval, bytes, and JA3 are identical across both populations, there is no licence server involved.
• The self-signed CN=localhost certificate is decisive on its own: no commercial licence service presents that. The claim is not credible.

DC-02 handling: do not power it off. Coordinate a controlled isolation window, capture memory first, and check for replication abuse - event 4662 with directory-replication GUIDs indicates DCSync, which would mean domain credential compromise and a two-tier krbtgt reset plan. Check for new computer accounts and changes to AdminSDHolder. Blocking egress on the DC while keeping it authenticating internally is the right first move: it stops the channel and preserves service while you determine whether the domain itself is now untrusted.