Create prompt-05.md

This commit is contained in:
Joas A Santos
2025-12-16 21:05:52 -03:00
committed by GitHub
parent 9694a89d9e
commit 2123d366d0

14
Blue Team/prompt-05.md Normal file
View File

@@ -0,0 +1,14 @@
Threat-hunt this potential C2 indicator: <IP or DOMAIN>
Observed pattern:
- Periodicity: <e.g., every 60s/5m/random>
- Bytes in/out: <RANGE>
- Protocol: <HTTP(S)/DNS/ICMP/OTHER>
- User-agent / SNI / JA3 (if known): <VALUES>
- Affected hosts count: <N>
Deliver:
- Beaconing assessment (why/why not)
- What to verify next (process lineage, scheduled tasks, persistence checks)
- Containment recommendation threshold (when to isolate)
- Detections to add (behavioral, not just IOC)