cti.arjay.dev

Threat intel & incident investigation lab

A working lab covering the full analyst pipeline — detection, investigation, adversary profiling, and OSINT-driven intelligence — built on Suricata, Kibana, Arkime, and the MISP/STIX stack. All scenarios below use public training datasets, reconstructed for practice.

Investigations

Three scenarios, each spanning detection through analyst conclusion.

01 — Suspected C2 Beaconing

Datasetpublic malware-traffic sample
ToolsSuricata · Kibana · Arkime
Kill chain stageCommand & Control

detection

Suricata flagged repeated outbound HTTP POST requests from a single host to one external IP, occurring at a near-fixed ~60 second interval.

triage

Pulled the alert timeline into Kibana to confirm the interval was consistent across the full session rather than a one-off spike — more typical of automated beaconing than user browsing.

deep dive

Reconstructed the session in Arkime: payload body was base64-encoded, and the User-Agent string did not match any legitimate browser/OS combination on the host.

T1071.001 — App Layer Protocol (Web)T1132 — Data Encoding
IndicatorValue
dst_ip203.0.113.44
beacon_interval~60s
user_agentanomalous, non-browser pattern

analyst conclusion

Traffic pattern and payload encoding are consistent with a low-and-slow C2 channel designed to blend into normal web traffic. Recommended: block the destination IP, alert on fixed-interval POST patterns, and hunt for the same beacon signature across other hosts.

02 — Suspected Data Exfiltration

Datasetsimulated internal-to-external transfer capture
ToolsArkime · Wireshark
Kill chain stageActions on Objectives

detection

Kibana dashboard showed an unusual spike in outbound byte volume from one internal host, well above its historical baseline, concentrated outside business hours.

triage

Filtered Arkime sessions to that host and time window; traffic was a single sustained connection to an external IP over a non-standard high port rather than normal web browsing.

deep dive

Exported the session and inspected it in Wireshark: payload was a compressed archive stream, consistent with staged files being pushed out in one bulk transfer.

T1048 — Exfiltration Over Alternative ProtocolT1560 — Archive Collected Data
IndicatorValue
dst_ip198.51.100.19
dst_port4444/tcp
bytes_out~1.2 GB in single session

analyst conclusion

Volume, timing, and non-standard port point to staged exfiltration rather than legitimate business transfer. Recommended: isolate the host, capture full packet data for the session, and review file access logs for the affected user account.

03 — Reconnaissance / Internal Scanning

Datasetsimulated post-compromise recon capture
ToolsSuricata · Kibana
Kill chain stageDiscovery / Lateral Movement Prep

detection

Suricata generated a burst of alerts from one internal host reaching many other internal IPs on the same port in a short window — a classic scanning signature.

triage

Kibana visualization confirmed a fan-out pattern: one source, dozens of destinations, sequential IP order, ruling out normal traffic.

deep dive

Cross-checked scanned ports against known services on the target subnet; the scan targeted a port associated with a file-sharing service, suggesting the attacker was mapping for lateral movement targets.

T1046 — Network Service DiscoveryT1018 — Remote System Discovery
IndicatorValue
src_ip10.10.4.22 (internal)
scanned_hosts47 in ~3 minutes
target_port445/tcp

analyst conclusion

Pattern is consistent with internal reconnaissance following an initial compromise. Recommended: contain the source host immediately, since fan-out scanning of this kind typically precedes lateral movement.

Adversary profile — Diamond Model

Built from Investigation 01.

adversary

Unattributed — infrastructure suggests a commodity C2 toolkit rather than bespoke tradecraft.

infrastructure

Single external IP, no observed domain rotation during the capture window.

capability

Base64 payload obfuscation, fixed-interval beaconing over HTTP.

victim

Single internal host, no evidence of lateral movement in this dataset.

OSINT & IOC collection

Collection flow used to take a raw indicator from an open feed to a structured, shareable object:

collect

Pulled a candidate IOC from an open threat-intel feed.

validate

Cross-referenced against a second independent source to confirm it wasn't a false positive or stale indicator, including a check against dark-web leak-forum chatter referencing the same infrastructure.

normalize

Structured the confirmed indicator into STIX 2.1 JSON with a confidence tag, ready for import into MISP.

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b1e2c3d4-1111-4a2b-9c3d-0f1a2b3c4d5e",
  "created": "2026-06-14T09:12:00Z",
  "pattern": "[ipv4-addr:value = '203.0.113.44']",
  "pattern_type": "stix",
  "valid_from": "2026-06-14T09:12:00Z",
  "confidence": 75,
  "labels": ["malicious-activity", "c2"]
}

Sample intelligence report

Written as if delivering findings to a SOC team.

Threat Intelligence Report — TIR-2026-003

Classification: TLP:AMBER (sample) · Analyst: A. Amatorio · Related: Investigation 01

summary

Host 10.10.2.17 exhibited fixed-interval outbound HTTP traffic to 203.0.113.44 consistent with C2 beaconing. Payload was base64-encoded to evade content inspection.

technical details

  • Beacon interval: ~60 seconds, sustained over a 40-minute capture window
  • Encoding: base64, decoded to a structured command string
  • ATT&CK: T1071.001, T1132

impact assessment

No confirmed data loss in this dataset. Beaconing alone indicates an established foothold; risk of follow-on exfiltration or lateral movement if left unaddressed.

recommendations

  • Block destination IP at the perimeter
  • Deploy detection rule for fixed-interval POST beaconing
  • Hunt across the environment for the same signature