Spot C2 Beaconing in Zeek Logs
forensics · medium · +45 XP
Target
GET /api/lab/zeek-101/conn-log (60s of Zeek conn.log entries)
POST /api/lab/zeek-101/submit body {src_ip, dst_ip, dst_port}
Goal: a single src↔dst pair shows a periodic ~60s beacon (std-dev < 2s) AND uses an uncommon high port. Submit src_ip, dst_ip, dst_port of that flow.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/zeek-101/
// reuse on the cli
// submit flag
// no solves yet
10 of 13 · forensics