A working lab covering the full analyst pipeline — detection, investigation, adversary profiling, and OSINT-driven intelligence — built on Suricata, Kibana, Arkime, and the MISP/STIX stack. All scenarios below use public training datasets, reconstructed for practice.
Suricata flagged repeated outbound HTTP POST requests from a single host to one external IP, occurring at a near-fixed ~60 second interval.
Pulled the alert timeline into Kibana to confirm the interval was consistent across the full session rather than a one-off spike — more typical of automated beaconing than user browsing.
Reconstructed the session in Arkime: payload body was base64-encoded, and the User-Agent string did not match any legitimate browser/OS combination on the host.
| Indicator | Value |
|---|---|
| dst_ip | 203.0.113.44 |
| beacon_interval | ~60s |
| user_agent | anomalous, non-browser pattern |
Traffic pattern and payload encoding are consistent with a low-and-slow C2 channel designed to blend into normal web traffic. Recommended: block the destination IP, alert on fixed-interval POST patterns, and hunt for the same beacon signature across other hosts.
Kibana dashboard showed an unusual spike in outbound byte volume from one internal host, well above its historical baseline, concentrated outside business hours.
Filtered Arkime sessions to that host and time window; traffic was a single sustained connection to an external IP over a non-standard high port rather than normal web browsing.
Exported the session and inspected it in Wireshark: payload was a compressed archive stream, consistent with staged files being pushed out in one bulk transfer.
| Indicator | Value |
|---|---|
| dst_ip | 198.51.100.19 |
| dst_port | 4444/tcp |
| bytes_out | ~1.2 GB in single session |
Volume, timing, and non-standard port point to staged exfiltration rather than legitimate business transfer. Recommended: isolate the host, capture full packet data for the session, and review file access logs for the affected user account.
Suricata generated a burst of alerts from one internal host reaching many other internal IPs on the same port in a short window — a classic scanning signature.
Kibana visualization confirmed a fan-out pattern: one source, dozens of destinations, sequential IP order, ruling out normal traffic.
Cross-checked scanned ports against known services on the target subnet; the scan targeted a port associated with a file-sharing service, suggesting the attacker was mapping for lateral movement targets.
| Indicator | Value |
|---|---|
| src_ip | 10.10.4.22 (internal) |
| scanned_hosts | 47 in ~3 minutes |
| target_port | 445/tcp |
Pattern is consistent with internal reconnaissance following an initial compromise. Recommended: contain the source host immediately, since fan-out scanning of this kind typically precedes lateral movement.
Unattributed — infrastructure suggests a commodity C2 toolkit rather than bespoke tradecraft.
Single external IP, no observed domain rotation during the capture window.
Base64 payload obfuscation, fixed-interval beaconing over HTTP.
Single internal host, no evidence of lateral movement in this dataset.
Collection flow used to take a raw indicator from an open feed to a structured, shareable object:
Pulled a candidate IOC from an open threat-intel feed.
Cross-referenced against a second independent source to confirm it wasn't a false positive or stale indicator, including a check against dark-web leak-forum chatter referencing the same infrastructure.
Structured the confirmed indicator into STIX 2.1 JSON with a confidence tag, ready for import into MISP.
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b1e2c3d4-1111-4a2b-9c3d-0f1a2b3c4d5e",
"created": "2026-06-14T09:12:00Z",
"pattern": "[ipv4-addr:value = '203.0.113.44']",
"pattern_type": "stix",
"valid_from": "2026-06-14T09:12:00Z",
"confidence": 75,
"labels": ["malicious-activity", "c2"]
}
Host 10.10.2.17 exhibited fixed-interval outbound HTTP traffic to 203.0.113.44 consistent with C2 beaconing. Payload was base64-encoded to evade content inspection.
No confirmed data loss in this dataset. Beaconing alone indicates an established foothold; risk of follow-on exfiltration or lateral movement if left unaddressed.