I85PREP
⌘ K
CTDC study materials
CTDC study resources

CTDC: Network Threat Detection and Traffic Analysis

CTDC · Work through your exam, one topic at a time.

All guide sections

Network Threat Detection and Traffic Analysis

Network Threat Detection and Traffic Analysis tests whether you can convert packets, flows and protocol metadata into findings you can defend - and explain why a pattern is malicious rather than merely unusual. Items combine IDS rule logic, behavioral analytics (beaconing, tunneling, exfiltration) and the hard visibility limits set by encryption and sensor placement.

Core rules

  • Placement sets visibility. A TAP or SPAN port at the internet edge cannot see east-west lateral movement; an internal sensor cannot see egress-only command and control. Cloud workloads need VPC traffic mirroring, flow logs or host capture because there is no physical tap to reach for.
  • Flow first, content second. NetFlow/IPFIX and Zeek conn.log provide 5-tuple, byte counts, duration and timestamps. Escalate to full PCAP only for sessions that survive triage; capture storage and privacy cost are real constraints.
  • Beaconing is statistical, not binary. Implants add jitter, but inter-arrival times still cluster. Score on low standard deviation of the interval, stable request-to-response size ratio, session longevity, destination rarity across the estate, and repetition across multiple hosts. One connection to a rare IP is not beaconing.
  • DNS is a channel. Tunneling shows long labels, high Shannon entropy in subdomains, TXT/NULL/CNAME abuse, and a single resolver client generating thousands of unique names. DGA traffic shows n-gram anomalies, consonant runs and elevated NXDOMAIN rates.
  • Encryption still leaks. SNI, certificate issuer and validity window, JA3/JA3S and JARM hashes, ALPN and packet-size distribution separate commodity browsers from commodity implants without decryption.

Worked example

A proxy logs 1,180 sessions from one workstation to a single /32 over 22 hours. Intervals average 58 seconds with 4 seconds standard deviation; uploads are 900-1,100 bytes and downloads 300-400; no other host contacts the destination; JA3 matches a known post-exploitation profile; the domain was registered nine days ago. Reasoning: rarity plus regularity plus a stable size ratio plus a tooling fingerprint is a strong C2 case. Any one criterion alone is not - legitimate update clients also poll on fixed intervals. The correct next step is targeted PCAP plus host triage, then an egress block at the perimeter.

Traps that cost marks

Treating a NAT address as the endpoint identity. Assuming port 443 implies TLS or that TLS implies benign. Ignoring clock skew between sensors when building a timeline. Calling any large transfer exfiltration without an outbound-to-inbound asymmetry baseline.