# Command & Control Beacon Analysis (lab)

> A scheduled threat hunt at an aerospace manufacturer. Nothing alerted. Ranking destinations by traffic volume and by domain reputation has already been tried twice and found nothing — every…

Canonical: https://codelivly.com/labs/c2-beacon

| | |
|---|---|
| Type | Investigation |
| Difficulty | Intermediate |
| Points | 350 |
| Session length | 45 min |
| Completions | 1 |

A scheduled threat hunt at an aerospace manufacturer. Nothing alerted. Ranking destinations by traffic volume and by domain reputation has already been tried twice and found nothing — every destination in the day's proxy log is something the business recognises. The hunt lead wants a different question asked this quarter.

## Objective

Learn to find an implant that is invisible to every technique based on where traffic goes or how much of it there is. You will measure the intervals between requests for each source-destination pair, use the coefficient of variation to separate machines from people, and — critically — learn why the most regular traffic in a network is almost never the malicious traffic.

## Tasks

1. Confirm the earlier hunts really do fail
2. Measure timing per source-destination PAIR
3. Resist the top of the ranking
4. Confirm with a second, independent signal
5. Scope it and map it

## Related

- [All labs](https://codelivly.com/practice?type=lab)