High-Confidence Intel, a Partner VPN, and Three Lab Hosts
A threat intelligence feed marks fourteen IP addresses as C2 infrastructure for a named APT, each with a vendor confidence of 'high' but a first-seen date two days ago. One of the fourteen resolves into a shared hosting range that also serves a business partner's VPN concentrator, as documented in the CMDB. Hunting over 30 days of Zeek conn.log and DNS logs finds three internal hosts beaconing to a different listed IP on 443 every 61 seconds with roughly 2 seconds of jitter, uploading about 1.2 KB each cycle, and resolving a newly registered domain via DoH so the DNS query never reaches the passive DNS feed. Asset inventory shows all three hosts are in the QA lab and run a synthetic monitoring agent that polls a SaaS endpoint on a fixed 60-second timer. The hunt lead has four hours before the weekly intel sync.
1. Is this a compromise? What single check most changes your assessment?
Read the worked answer
Probably not the beaconing. The DoH query is the finding worth chasing.
Weighing it:
- A 61-second interval with roughly 2 seconds of jitter matches a human-configured monitoring timer, not the percentage-based jitter typical of C2 frameworks, and inventory names a synthetic agent on exactly those hosts.
- 1.2 KB per cycle is consistent with a heartbeat, which cuts both ways, because implants also send heartbeats.
- The vendor's 'high' confidence is undermined by a two-day first-seen date. Two-day-old infrastructure is churning infrastructure; a single vendor label at that age is a weak basis for blocking or for declaring an incident.
The decisive check: which process on those hosts issued the DoH query, and whether it matches the monitoring agent's documented binary and destination. If it is the signed agent, the beacon hypothesis closes. If it is an unsigned binary, unfiled, or has no credible parent chain, you have a real lead that the beacon data alone would never have surfaced.
2. What do you do with the shared-hosting IP that also serves the partner's VPN?
Read the worked answer
Do not block it. Treat it as an attribution problem with a business owner.
- Confirm ownership through WHOIS, the hosting provider's abuse contact and the partner's published egress ranges. A VPN concentrator and C2 on the same shared range is common; sharing a range proves nothing.
- Ask the partner in writing, through the account manager rather than the abuse desk, to confirm the address is their egress.
- Hunt before blocking: search 30 days of firewall and proxy data for internal hosts connecting to that address outside the documented partner tunnel. If none do, blocking gains nothing and risks the VPN.
- If a host does connect outside the tunnel, that is your finding. Block that host or path rather than the enterprise edge.
- Record the exemption in the intel platform with an expiry date, so the next analyst does not re-litigate it and the exception gets reviewed rather than forgotten.
Blocking is the easy answer here; it is also the one that severs a business link on unproven evidence.
3. Which pivots do you run next, and what would make you escalate to incident?
Read the worked answer
Pivot outward from the DoH anomaly, because the beacon data is contaminated by a known benign process.
Pivots:
- Process tree on the three hosts around the DoH query: parent, image path, signature, first-seen time in the environment.
- TLS metadata for the connection to the listed IP: certificate serial, issuer, JA3 and JA4 fingerprints. A self-signed or reused certificate appearing on other hosts is a strong find.
- Search all proxy and firewall logs for the same JA3, JA4 or certificate serial across 90 days; that catches hosts the IP-based hunt misses once infrastructure rotates.
- Passive DNS on the new domain: registration date, registrar, name servers. Look for other domains sharing those name servers.
Escalate if the DoH query comes from an unmanaged or unsigned binary, if the certificate or fingerprint appears outside the QA lab, or if any internal host reaches a listed IP without going through the partner tunnel. Otherwise close the hunt with the agent evidence documented and the intel marked disputed at source.