Lab Demonstrates How Network Monitoring Can Reveal C2 Beacons

Summary

A red-team lab demonstrates how firewall sessions, network-flow alerts and proxy logs can reveal beacon traffic and staged payloads, while discussing visibility gaps and evasion tradeoffs.

Key points

• The presenter uses a virtual pfSense network and test beacons to examine network visibility rather than endpoint protection.
• pfTop showed persistent connections to the test C2 host, including a session that remained established despite a 10-second beacon sleep interval.
• Ntopng exposed multiple hosts communicating with the same destination and flagged a self-signed TLS certificate.
• The presenter correlated firewall sessions, Zeke logs and Ntopng alerts to identify the lab beacons.
• A Squid-connected host blocked a staged HTTPS payload on port 444, while a host not using the proxy established a session.
• The presenter discusses how redirectors, customized certificates and alternative staging methods could change the signals available to defenders.