Capture, analyze, and report, network forensics exercises for C2 beaconing and covert exfiltration channels
The network sensor at Tidewater Municipal Utility flags periodic outbound traffic from HMI-ENG01, an engineering workstation on the OT network. Analyze a rendered packet list, Zeek conn/dns/ssl logs, and a decoded proxy log to determine whether the traffic is benign telemetry or command-and-control beaconing, identify the exfiltration channel, and quantify what left the network.