Lion Cipher Lab
Block now or watch first? Decide what to do about a live C2 domain by measuring the intelligence you gain and the damage you risk
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
It is the question every incident lead gets, and a classic interview question: you have confirmed malware calling home from three machines. Do you cut it off right now, or do you watch for a while to see how big the problem really is? Both answers are defensible, and both can be badly wrong. Block too early and you clean up three machines while the attacker keeps a fourth you never saw, now warned and changing tactics. Watch too long and you are the team that let 160 MB walk out the door while you took notes. This lab turns that argument into numbers you produce yourself, then gives you the…
What you'll learn
- framing the defender's intelligence gain/loss trade-off: what blocking a confirmed command-and-control (C2) domain at hour 0 buys (it stops the bleeding) and what it costs (it tells the attacker you are onto them and ends your view of their next move)
- measuring both paths on one inert proxy log: block at hour 0 knows 3 hosts and 1 domain, a 24-hour watch knows 5 hosts and 2 domains, and a one-hour beacon hunt at hour 0 already knows 4 hosts and 2 domains
- separating what the watch FOUND (FS-02, infected before hour 0) from what the watch CAUSED (WS-040, infected at hour +14 while you watched) so hindsight does not count a cost as a win
- pricing the watch: 160.6 MB left to C2 inside the window, and a 10 MB upload tripwire plus 30-minute containment would have capped it at 39.0 MB
- scoring both paths against a seven-factor rubric (data sensitivity, evidence of exfiltration, legal clock, ability to contain all at once, risk to life or safety, adversary awareness, destructive staging) and flipping one fact at a time until the answer flips
- writing a defensible decision: the pick, three numbers that justify it, an owner, an approval, a hard stop and tripwires
Steps in this lab
- The words first: C2, beacon, containment, tipping off, and the gain/loss trade-off
- Open a terminal and make a scratch folder (Windows, macOS, Linux)
- Generate the inert proxy log: 72 hours, 8 hosts, one confirmed C2 domain and one nobody has noticed
- Measure both paths: what block-at-0 knows, what a 24-hour watch learns, and what the watch cost
- Read the numbers honestly: what the watch found, what it caused, and hindsight
- Score both paths against the rubric
- Flip the scenario until the answer flips
- Write the decision the way you would defend it to an incident lead (or an interviewer)
- The judgment: when to watch, when NOT to, and how a pro does it