Lab 14 · threat intelligence · the finale

One indicator, the whole house.

A single confirmed bad indicator is a loose thread. Pull it through the things the adversary reused — a TLS certificate, a registration pattern, a favicon, a passive-DNS history — and the rest of their infrastructure comes with it. This is the analyst's multiplier: one domain becomes a map. The craft is knowing which threads are the adversary's own and which are shared by half the internet, because the fastest way to burn a day is to pivot onto a CDN and “discover” Cloudflare.

01 — why it works

Attackers reuse, and reuse leaves links

Infrastructure costs effort, so operators recycle it: the same self-signed cert across panels, the same registrant identity, the same host, the same hand-built C2 landing page (and thus the same favicon). Each reused attribute is an edge you can traverse from a known-bad node to its unknown siblings. The whole game is edge quality: pivot on something specific to this adversary, not something they happen to share with everyone.

strong edgesAttributes rare enough to be near-unique: a specific self-signed TLS cert (SHA-1/SHA-256), a reused registrant email, a hand-rolled panel's favicon hash (mmh3), a distinctive JARM/JA3S TLS fingerprint. A match here is a real link.

weak edgesAttributes shared by millions: a cloud ASN, a CDN IP, a privacy-proxy WHOIS, a Let's Encrypt issuer. A match here means almost nothing on its own — it's a hint, not a link.

the methodExpand on strong edges, corroborate across two+ independent edges before you claim a node, and prune anything that only connects through a weak edge. Confidence is per-edge, and the cluster is only as good as its weakest included link.

02 — build the cluster

Pivot from one seed

Seed: the C2 IP confirmed back in Labs 4 & 7. Run each pivot and watch the infrastructure assemble — strong edges add confirmed siblings, the ASN pivot is withheld as too broad, and the CDN pivot drags in an innocent bystander you'll have to prune. Build the house, then check your work.

● 185.220.101.47 · confirmed C2 (Lab 4/7)

Run pivots to assemble the cluster.

03 — the pivot set

What each thread reveals — and its trap

passive DNSHistorical domain↔IP resolutions from recursive-resolver telemetry (Farsight/DNSDB-style). Reveals every domain that ever pointed here. Trap: shared/parked hosting means co-residents who aren't related.

TLS certificateCertificate Transparency + scan data: same cert hash, SANs, or self-signed subject across hosts. Strong when the cert is bespoke. Trap: wildcard/shared-panel certs and Let's Encrypt reuse.

WHOIS / registrantRegistrant email, org, nameservers, registration timing. Reused identity or same-day bulk registration is a strong cluster. Trap: privacy proxies redact nearly everything now.

favicon hashmmh3 hash of the site's favicon (Shodan/Censys indexable). A hand-built C2 panel reused across hosts shares an exact favicon. Trap: default framework favicons are everywhere.

JARM / JA3SActive/observed TLS-stack fingerprints. Clusters hosts running the same C2 server software. Trap: popular stacks (nginx, Cobalt-Strike-lookalikes) collide with legit servers.

ASN / netblockThe hosting network. Useful as context (bulletproof hosters recur). Trap: never a link by itself — an ASN holds millions of unrelated hosts.

04 — the hard part

The fastest way to be wrong

Shared infrastructure is a bystander factory. Pivot onto a Cloudflare IP or a shared host and you'll “find” thousands of unrelated sites. Every one you include is a false accusation. Weak edges get pruned, not clustered.
WHOIS is mostly dark now. Post-GDPR redaction and privacy proxies mean registrant pivots often dead-end. Absence of a link isn't absence of a relationship.
Passive beats active — and it's the legal line. Enriching an indicator from OSINT and passive telemetry is analysis. Actively scanning or connecting to the adversary's infrastructure is a different activity with different rules; this lab stays on the passive side of that line, and so should you.
A cluster is a hypothesis. Two independent strong edges make a confident link; one makes a lead. Everything you assemble feeds back into the timeline (Lab 7) and the actor model (Lab 13) as evidence, not verdict.

The series, closed. Fourteen labs, first instruction to full campaign: the boot sector (1), the kernel's call tables and views (2–3), the network — C2, streams, signatures, DNS (4, 4B, 5, 12), the host — memory, sleds, files, exploitation, persistence (6, 8, 9, 10, 11), and the humans — the case, the operator, the infrastructure (7, 13, 14). Measure the ground; never become it.

05 — provenance & citations

Where this comes from

sources & tooling Caltagirone, Pendergast & Betz (2013). The Diamond Model — the analytic pivot is the model's core operation.
Farsight / DNSDB passive DNS · Certificate Transparency logs · Shodan / Censys (favicon & JARM) · MISP (indicator sharing).
Althouse et al. — JARM / JA3S TLS fingerprinting (Salesforce).

this lab github.com/Mik3XC/BlueTeamLab
MITRE ATT&CK — Reconnaissance / Resource Development (adversary infrastructure).
Consumes the seeds from Lab 4 & Lab 12; feeds Lab 7 & Lab 13.

Next: Lab 15 — a graded capstone exercise: a full intrusion to work end-to-end across every lab.