Lion Cipher Lab
Spot botnet beaconing: intervals, jitter, and the tells that separate bots from browsers
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A botnet is only useful to its operator if the infected machines keep checking in for orders — and that check-in is the one thing the malware cannot stop doing. It can encrypt its payload, blend into HTTPS, rotate its domains overnight, and sign its own certificate, but it still has to phone home on some schedule, and a schedule is a timing pattern a human analyst can measure. That is the whole game of hunting command-and-control: not decrypting the traffic, but reading the ENVELOPE — how often, how uniformly, to where, carrying what identifier. This drill gives you that eye on realistic…
What you'll learn
- measuring the beacon interval by subtracting connection timestamps
- reading jitter as bounded randomness around a fixed schedule (not noise)
- recognising uniform, small request/response sizes as an automated check-in
- pulling the bot-ID / infected-host identifier out of a decoded check-in
- distinguishing DGA (algorithmic, high-entropy, NXDOMAIN-heavy) DNS from normal lookups
- contrasting bursty, varied human browsing against a metronomic bot
- mapping the findings to MITRE ATT&CK T1071, T1568.002, and T1102
- judgment: when timing analysis reveals a beacon and when low-and-slow hides it
- pivoting a confirmed beacon into IOCs (C2 address, DGA domains, bot-ID)
Steps in this lab
- What botnet beaconing is, and the one thing the malware can't hide
- Your scenario and your artifacts (analyst's chair)
- The connection log — find the beacon by its interval
- Jitter — why the gaps aren't identical (and why that's still a beacon)
- Uniform, tiny sizes — the second half of the beacon signature
- The decoded check-in — read the bot-ID
- The DNS log — DGA vs normal lookups
- The contrast set — what a human actually looks like
- The judgment: when timing wins, when it's fooled, and how a pro finishes the job