C2 Traffic Analysis

PCAP="/cases/CASE-2026-009/network/filtered-suspect.pcap"
SUSPECT_IP="185.220.101.47"

# Extract all connection timestamps to the suspect IP
tshark -r $PCAP \
    -Y "ip.dst == $SUSPECT_IP && tcp.flags.syn == 1 && tcp.flags.ack == 0" \
    -T fields -e frame.time_epoch \
    | sort -n > /tmp/connection-times.txt

# Calculate inter-connection intervals (Python)
python3 << 'EOF'
import sys

times = [float(t) for t in open('/tmp/connection-times.txt').read().split()]
if len(times) < 2:
    print("Not enough connections")
    sys.exit()

intervals = [times[i+1] - times[i] for i in range(len(times)-1)]
avg = sum(intervals) / len(intervals)
stdev = (sum((x - avg)**2 for x in intervals) / len(intervals)) ** 0.5
low_cv = stdev / avg  # coefficient of variation — low = highly regular

print(f"Total connections: {len(times)}")
print(f"Average interval: {avg:.1f} seconds ({avg/60:.1f} minutes)")
print(f"Std deviation:    {stdev:.1f} seconds")
print(f"Min interval:     {min(intervals):.1f}s  Max: {max(intervals):.1f}s")
print(f"Coefficient of variation: {low_cv:.3f}")
print()
if low_cv < 0.15:
    print("HIGH CONFIDENCE BEACON: Very regular interval (CV < 0.15)")
    print(f"Possible sleep setting: {avg:.0f}s with ~{stdev/avg*100:.0f}% jitter")
elif low_cv < 0.30:
    print("MODERATE CONFIDENCE BEACON: Somewhat regular interval")
else:
    print("Low regularity — may not be beacon, or high jitter setting")
EOF

PCAP="/cases/CASE-2026-009/network/full-capture.pcap"

# Extract JA3 fingerprints using zeek (formerly known as Bro)
# Zeek processes the PCAP and generates logs including ssl.log with ja3 fields
zeek -r $PCAP /opt/zeek/share/zeek/policy/protocols/ssl/ja3.zeek

# Extract JA3 hashes from zeek ssl.log
awk -F'\t' '{print $8, $9, $4}' ssl.log | sort | uniq -c | sort -rn | head -30
# Fields: ja3, ja3s, server_name

# Alternative: use ja3 Python package directly against PCAP
pip install pyshark
python3 << 'EOF'
import pyshark

cap = pyshark.FileCapture(
    '/cases/CASE-2026-009/network/full-capture.pcap',
    display_filter='tls.handshake.type == 1'
)

ja3_counts = {}
for pkt in cap:
    try:
        # ja3 is available if tshark has ja3 dissector enabled
        ja3 = pkt.tls.handshake_ja3
        dst = pkt.ip.dst
        sni = pkt.tls.handshake_extensions_server_name
        key = f"{ja3}|{dst}|{sni}"
        ja3_counts[key] = ja3_counts.get(key, 0) + 1
    except:
        pass

cap.close()
for k, v in sorted(ja3_counts.items(), key=lambda x: -x[1])[:20]:
    ja3, dst, sni = k.split("|")
    print(f"{v:4d}  JA3:{ja3}  dst:{dst}  SNI:{sni}")
EOF

PCAP="/cases/CASE-2026-009/network/full-capture.pcap"

# If traffic is decrypted (SSLKEYLOGFILE available):
# Compare TLS SNI (in ClientHello) vs HTTP Host header
# These should match for legitimate traffic
# Mismatch = domain fronting

tshark -r $PCAP \
    -Y "http.host && tls.handshake.extensions_server_name" \
    -T fields \
    -e ip.dst \
    -e tls.handshake.extensions_server_name \
    -e http.host | \
    awk '$2 != $3 && $2 != "" && $3 != ""' | \
    head -20
# SNI != Host header = domain fronting indicator