Lion Cipher Lab
Characterize a RAT's command-and-control: persistence, DNS, HTTP, and connection pattern
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
In a real incident you are almost never handed the malware first. You are handed evidence: a suspicious autostart entry an endpoint tool flagged, some DNS logs, a proxy line, a NetFlow record, one process-create event. Your job is to turn that pile into a sentence a defender can act on: 'this host is running a Remote Access Trojan that persists via a Run key, checks in to telemetry-sync-api[.]net every 60 seconds over HTTP, and is being tasked with commands.' A Remote Access Trojan (RAT) is malware that gives an attacker interactive, hands-on-keyboard control of a machine — it phones home,…
What you'll learn
- reading a Run-key persistence artifact and recognising a masquerading autostart entry
- reconstructing a DNS -> HTTP check-in flow from separate logs
- spotting a distinctive C2 URI path and a fixed, unusual User-Agent as durable IOCs
- decoding a base64 tasked command out of a check-in response
- measuring a beacon interval from timestamps in a connection log and reading byte-size jumps as task results
- distinguishing an interactive, tasked RAT from a simple single-purpose bot
- mapping the behaviour to MITRE ATT&CK (T1071.001, T1547.001, T1219) and pivoting C2 indicators to find other infected hosts
Steps in this lab
- The analyst's chair: what a RAT is, and what you were handed
- The evidence bundle (read it once, top to bottom)
- Artifact 1 — read the persistence: how it survives a reboot
- Artifacts 2 + 3 — trace the DNS -> HTTP check-in to the controller
- Decode the tasked command — and watch it run (Artifacts 3 + 5)
- Artifact 4 — measure the beacon cadence and read the byte sizes
- RAT or just a bot? Why this evidence says interactive
- Correlate into one story: the IOC list, the MITRE map, and the pivot
- The judgment call: when these artifacts are enough, and when they aren't