Malware Traffic Analysis and Indicators of Compromise
This domain tests malware traffic analysis: recognizing delivery, command-and-control, and exfiltration from packets, flows, and indicators. Expect beaconing, DNS tunneling, DGA, payload retrieval, and encrypted C2 metadata.
Core rules
Separate IOCs-atomic observables such as IPs, domains, hashes, URI paths, JA3 fingerprints-from TTPs, the adversary’s behavior. IOCs age quickly; TTPs support hunting. Delivery often appears as HTTP GET for a small loader, a redirect chain, or a file download with mismatched Content-Type. C2 may use regular intervals with jitter, small request/response sizes, rare user-agents, or domains with high entropy. DNS tunneling shows long, encoded labels, high query volume, and TXT/NULL records.
Encrypted traffic still yields metadata: SNI, certificate issuer/subject, JA3/JA3S, packet sizes, and timing. Validate candidates against baseline and asset role. A finance workstation querying a rare domain is more suspicious than a security scanner doing the same.
Worked example
A host resolves 30 random-looking subdomains of one parent domain every 45 seconds, each with a long base32 label and TXT response. No browser process is associated, and the parent domain is eight days old. Reasoning: the label structure and periodic TXT queries indicate DNS tunneling or DGA-based C2. Pivot to the resolver logs, identify other hosts, and preserve the PCAP before sinkholing.
Traps
Labeling every periodic connection as C2-software updates and telemetry also beacon; ignoring CDN and shared-hosting false positives; and overstating attribution from an IP. Also do not rely on a single IOC without timeline context.