1. 1. Identify the C2 framework What are you looking at? Cobalt Strike beacon (malleable C2 profile, named pipes, sleep/jitter pattern), Sliver, Brute Ratel, Mythic, Havoc, or a custom implant. The framework determines what artifacts to look for on other hosts. Check the process, its parent, loaded DLLs, network connections, and injected threads. NET: C2 · Sysmon EID 1/3/7/10
2. 2. Extract C2 infrastructure Destination IPs/domains, ports, callback interval, JA3/JA4 hash, HTTP headers and URI patterns, SSL certificate details. These become network-wide hunt indicators. Pull from Sysmon EID 3 (network), Zeek conn.log, ssl.log, http.log, and DNS logs. NET: C2 · Zeek ssl.log/http.log · Arkime sessions
3. 3. Determine how long the beacon has been active First callback timestamp in network logs. Process creation time (Sysmon EID 1). File creation time of the beacon binary. Earliest DNS resolution of the C2 domain. The dwell time determines how much damage to scope for. Zeek conn.log earliest session to C2 IP · Sysmon EID 1 process create time
4. 4. Determine the initial delivery mechanism How did the beacon get onto this host? Check the process tree: beacon's parent process reveals the delivery chain. Office app parent = maldoc. Browser parent = drive-by or download. WmiPrvSE parent = lateral movement from another host. Service parent = PsExec deployment. This tells you whether this host is patient zero or a lateral target. HOST: Execution · Sysmon EID 1 parent chain

1. 5. Hunt for the same C2 across the network Take the C2 indicators from step 2 and sweep everything: Zeek conn.log for the destination IPs, dns.log for the domains, ssl.log for the JA3 hash, http.log for the URI pattern. Any other host talking to the same infrastructure is also compromised. NET: C2 · Arkime: ip.dst == <C2_IP>
2. 6. Check for credential access on the beaconed host Did they dump credentials? Sysmon EID 10 targeting lsass.exe, reg save commands for SAM/SYSTEM/SECURITY, Mimikatz command-line artifacts, Kerberos ticket requests (EID 4769). If they dumped creds, every account that was logged into this host is burned. HOST: T1003.001 LSASS · T1003.002 SAM
3. 7. Trace lateral movement from this host Using the credentials they stole: PsExec service creation on other hosts (EID 7045), RDP type 10 logons sourced from this host's IP, WMI execution (WmiPrvSE children on targets), SSH connections to Linux hosts. Build the movement map: where did they go from here? HOST: Lateral Movement · EID 4624 source IP = beaconed host
4. 8. Check for persistence beyond the beacon Attackers rarely rely on a single implant. Check for: additional scheduled tasks, new services, registry Run keys, SSH authorized_keys additions, WMI event subscriptions, DLL search-order hijacks. Each persistence mechanism is a separate re-entry path that survives beacon removal. HOST: Persistence (all techniques)
5. 9. Check for discovery commands run through the beacon What did they learn? whoami /all, systeminfo, net group "Domain Admins", ipconfig, tasklist, net share, ADFind. The discovery commands tell you what they know and what they're planning. If they enumerated Domain Admins, expect credential targeting next. HOST: Discovery (all techniques)
6. 10. Look for data staging and exfiltration Did they collect and move data? Archive creation (7z, rar), file copies to staging directories, Rclone or MEGAcmd execution, large outbound HTTPS sessions, DNS tunneling. The C2 channel itself may be the exfil path (Cobalt Strike's download command). NET: Exfiltration · Collection

1. 11. Build the compromise map At this point you should have: the initial access vector, the list of compromised hosts, the credentials that are burned, the persistence mechanisms across all hosts, and whether data was exfiltrated. This is the briefing: here's what they had access to, here's how long they had it, and here's what we need to reset.
2. 12. Identify the actor (if possible) Feed your starred indicators into ATTRIB. The C2 framework, lateral movement tools, and specific technique choices narrow the actor pool. Even if you can't name the group, the nation-state vs. criminal distinction changes the response: criminals want money, nation-states want persistence. ATTRIB engine

Every actor from commodity criminals to top-tier nation-states uses C2 implants. The framework choice is the first attribution signal: Cobalt Strike is used by everyone (60%+ of IR engagements). Sliver and Brute Ratel are growing as CS detection improves. APT29 uses custom implants (WellMess, EnvyScout) alongside commodity frameworks. APT41 favors ShadowPad and PlugX. Lazarus uses custom backdoors with distinctive C2 protocols.