C2 Investigation & Network Scoping: How Far Did They Get?

Prerequisites

• CIR-K003: Live Response Triage
• COA-K005: C2 Beaconing & DNS Exfiltration Detection (recommended)

Why This Lesson Matters

Scope determination is the hardest part of IR. "How many systems are compromised?" is a question your management, your legal team, and your regulator will all ask. Answering it requires following the C2 infrastructure — the attacker's communication channel — outward from the confirmed hosts and inward from network logs. This lesson teaches you to scope an incident confidently using C2 analysis and lateral movement tracing.

1. Why C2 Analysis Drives Scope

The attacker's C2 channel is the single best indicator of compromise for scoping because:

• Every compromised host phones home to the C2
• The C2 IP or domain is the same across all infected hosts
• Network logs are available even on hosts you have not yet examined directly
• Firewall and DNS logs often cover weeks of history

Strategy:
1. From confirmed host → extract C2 IP/domain
2. Search ALL network logs (firewall, DNS, proxy) for that C2 indicator
3. Every internal IP that communicated with the C2 = potentially compromised
4. Investigate each identified host to confirm or rule out compromise

This is the fastest way to answer "how many systems?" without manually examining every host.

2. Extracting C2 Indicators from a Compromised Host

From your live response triage (CIR-K003):

# Active outbound connections to external IPs
ss -antp | grep ESTAB | grep -v "127.0.0.1|::1" | 
  awk '{print $5}' | sort -u

# DNS queries made recently (if system resolver logs or dnsmasq is present)
cat /var/log/syslog | grep "dnsmasq|named|resolved" | grep -v "127.0.0.53"

# Process-to-connection mapping
for pid in $(ss -antp | grep ESTAB | grep -oP 'pid=K[0-9]+'); do
  echo "PID $pid: $(cat /proc/$pid/cmdline 2>/dev/null | tr '' ' ')"
done

On Windows (from Sysmon logs already collected):

# Sysmon Event 3 (network connection) from suspicious processes
Get-WinEvent -Path .sysmon.evtx |
  Where-Object {$_.Id -eq 3} |
  ForEach-Object {
    [xml]$xml = $_.ToXml()
    [PSCustomObject]@{
      Time        = $xml.Event.System.TimeCreated.SystemTime
      Image       = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "Image"} | Select-Object -Expand "#text"
      DestIP      = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "DestinationIp"} | Select-Object -Expand "#text"
      DestPort    = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "DestinationPort"} | Select-Object -Expand "#text"
    }
  } | Where-Object {$_.DestIP -notmatch "^10.|^192.168.|^172.16."} |
  Sort-Object Time

3. Pivot: From C2 IP to All Infected Hosts

Once you have the C2 IP (e.g., 185.220.101.5):

3.1 Firewall Logs

# Search perimeter firewall logs for this IP (last 30 days)
grep "185.220.101.5" /var/log/firewall.log | 
  awk '{print $7}' | sort | uniq -c | sort -rn
# $7 = source internal IP (position depends on your log format)

# Group by internal source IP to find all communicating hosts
awk '/185.220.101.5/ {print $7}' firewall.log | sort | uniq -c | sort -rn

3.2 DNS Logs

# If the C2 uses a domain, search DNS logs
grep "evil-c2-domain.com" /var/log/named/query.log | 
  awk '{print $1}' | sort | uniq -c | sort -rn
# Each unique source IP = a host that resolved the C2 domain

3.3 Proxy Logs

# HTTP proxy logs often have the full URL
grep "185.220.101.5|evil-c2-domain.com" /var/log/squid/access.log | 
  awk '{print $3}' | sort | uniq -c | sort -rn
# $3 = client IP in Squid log format

4. Lateral Movement Tracing

After identifying all C2-communicating hosts, trace the path the attacker took between them.

4.1 Building the Lateral Movement Graph

Confirmed path so far:
  185.220.101.5 (external) → WS-042 (initial access, SSH brute force)
                           → SRV-001 (lateral movement via Pass-the-Hash)

Questions to answer:
  Did SRV-001 connect anywhere else?
  Did WS-042 connect to any other internal hosts?

# On SRV-001: which internal IPs did this server connect TO?
grep "SRV-001|10.0.0.1" /var/log/firewall.log | 
  grep -E "10.0.0.[0-9]+" | 
  awk '{print $8}' | sort | uniq
# Compare against known-good connections baseline

4.2 Authentication Log Pivot

# On each server in scope: who authenticated FROM where?
Get-WinEvent -Path .security.evtx -FilterHashtable @{Id=4624} |
  ForEach-Object {
    [PSCustomObject]@{
      Time       = $_.TimeCreated
      User       = $_.Properties[5].Value
      LogonType  = $_.Properties[8].Value
      SourceIP   = $_.Properties[19].Value
    }
  } | Where-Object {$_.LogonType -eq 3 -and $_.SourceIP -ne "-"} |
  Group-Object SourceIP | Sort-Object Count -Descending

Any Type 3 logon from a workstation IP to a server IP = possible lateral movement.

5. Building the Scope Statement

After running the above, you should be able to produce:

SCOPE STATEMENT — IR-2026-0608-001 (Updated: 15:30 UTC)

CONFIRMED COMPROMISED HOSTS:
- WS-042 (10.0.0.42)    Initial access via SSH brute force at 14:30 UTC
- SRV-001 (10.0.0.1)    Lateral movement via PtH at 14:31 UTC

POTENTIALLY COMPROMISED (pending investigation):
- SRV-003 (10.0.0.3)    Event 4624 Type 3 from SRV-001 at 14:35 UTC
- WS-019 (10.0.0.19)    DNS query for evil-c2-domain.com at 14:33 UTC

RULED OUT:
- All other hosts: no firewall, DNS, or auth log matches for C2 indicators

DATA AT RISK:
- SRV-001 hosts: finance database (PII scope), HR share
- Potential PIPEDA breach notification obligation if data was exfiltrated
  → Exfiltration investigation ongoing (see CIR-K009 timeline)

SCOPE LAST UPDATED: 2026-06-08 15:30 UTC
NEXT UPDATE: 2026-06-08 17:00 UTC

Keep the scope statement live — update it as new evidence arrives.

6. Common Mistakes

Mistake 1: Assuming scope is final after the first assessment. Scope grows as investigation proceeds. A host that looks clean at T+1 hour may show C2 activity when DNS logs for the previous week are analysed at T+4 hours.

Mistake 2: Only checking the confirmed C2 IP and ignoring related infrastructure. Attackers use multiple C2 IPs. Once you confirm one, check VirusTotal's "Relations" for nearby infrastructure and hunt for those too.

Mistake 3: Declaring "no data exfiltration" without checking. "We found no evidence of exfiltration" is different from "we confirmed no exfiltration occurred." Check DNS query volume, outbound transfer sizes, and cloud storage access logs before making this claim.

7. Practice Exercises

1. Your firewall log search for C2 IP 185.220.101.5 returns connections from: 10.0.0.42, 10.0.0.55, 10.0.0.87. WS-042 is 10.0.0.42. What do you do with 10.0.0.55 and 10.0.0.87?

2. DNS logs show 3 hosts queried evil-c2-domain.com: 10.0.0.42, 10.0.0.19, and 10.0.0.200. The last two have no corresponding firewall hits. What might explain this? Is this reassuring or still concerning?

3. Write a scope statement update (3 sentences) after discovering that a third host SRV-003 made a Type 3 logon to a domain controller using the compromised Administrator credential.

8. Lab

Assessment mode: flag

challenge_spec_id: 369 — C2 beaconing detection

You are given a netflow CSV file containing connections from multiple internal hosts.

Task: 1. Identify the C2 IP (external IP with beaconing pattern from multiple internal sources) 2. List all internal IPs that communicated with the C2 (these are in-scope hosts) 3. Identify which internal IP had the highest connection count (patient zero) 4. The flag is: PREFIX{c2_ip:patient_zero_ip:total_infected_count}

9. Framework Alignment

10. Further Reading

• Threat Hunting with Elastic SIEM — Practical C2 pivot techniques using ECS-normalised data
• MITRE ATT&CK — Command and Control (TA0011) — Full catalogue of C2 techniques with detection notes
• Cobalt Strike Beacon Indicators — https://blog.cobaltstrike.com — Understanding what you are hunting

["Extract a C2 IP or domain from a running compromised host using ss, /proc, and Sysmon Event 3, then pivot to firewall and DNS logs to identify all internal hosts that communicated with the C2", "Build a lateral movement graph by correlating Windows Event 4624 Type 3 logons across multiple hosts and identify the source and destination of each hop", "Produce a scope statement with confirmed compromised, potentially compromised, and ruled-out hosts, and include a data-at-risk assessment for each confirmed host"]

Prerequisites → Why this matters → C2 analysis drives scope → Extracting C2 indicators from host (Linux + Windows Sysmon) → Pivot: C2 IP to all infected hosts (firewall, DNS, proxy logs) → Lateral movement tracing (graph building, auth log pivot) → Building the scope statement (live document) → Common mistakes → Practice exercises → Lab (flag, spec 369) → Framework alignment → Further reading