Lion Cipher Lab

Write a C2 beaconing detector from scratch (statistical hunting over Zeek logs)

• SOC Analyst / Blue Team
• Advanced
• ~75 min
• Free · no account required

Why it matters

Modern command-and-control (C2) traffic is almost all encrypted. An implant on a compromised host phones home to its C2 server over TLS on 443, and you cannot decrypt it to read the payload -- so the classic move of inspecting content is blind. But the malware has a tell it cannot fully hide: it has to call home on a schedule, and a schedule is REGULAR in a way human-driven traffic never is. That regularity in the TIMING is the signal, and timing survives encryption. Learning to read it turns 'the traffic is encrypted, we are stuck' into 'the traffic is encrypted, so let me time it.' This lab…

What you'll learn

• what C2 beaconing is and why REGULARITY, not payload, is the signal in encrypted traffic
• reading Zeek conn.log the way Zeek writes it (ts, id.orig_h, id.resp_h, id.resp_p, orig_bytes, resp_bytes)
• grouping traffic into sessions by the (src, dst, dst_port) tuple and computing inter-arrival deltas
• scoring timing regularity with the coefficient of variation (std / mean) and a minimum-connection floor
• adding a data-size-consistency signal so small, uniform payloads reinforce the score
• playing the adversary: defeating your own detector with Cobalt-Strike-style sleep-and-jitter
• re-tuning with a longer observation window and an FFT / autocorrelation view of the interval series
• naming the false-positive sources honestly (NTP, update pollers, OCSP, SaaS keepalives, telemetry)
• the judgment of when timing analysis wins, when it fails, and how RITA productionizes this exact idea

Steps in this lab

1. What beaconing is, and why timing is the signal
2. Get self-contained data: generate a synthetic Zeek conn.log
3. Parse the log into sessions by (src, dst, dst_port)
4. Score timing regularity with the coefficient of variation
5. Run it and watch the beacon rise -- next to your top false positive
6. The adversary round: add jitter and watch confidence collapse
7. Re-tune -- and pay the false-positive tax honestly
8. The judgment: when this wins, when it fails, and how the pros do it

Open the full interactive lab →