A connection every minute, like clockwork
Encrypted traffic hides content but not timing. Use TLS Client Hello metadata to find the host that calls the same server on a steady interval and measure that interval.
Briefing
Threat intel says a commodity implant checks in over HTTPS on a fixed timer with small jitter. You have eight minutes of traffic from the engineering VLAN in /cases/eng.pcap.
You cannot read TLS payloads, but the Client Hello carries the server name (SNI) in clear text, and frame.time_relative tells you when each one was sent.
sensor-04 · Packet captures
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.