Hunting with Flow Data

Try it out loud first. Then check yourself:

1. NetFlow/IPFIX/VPC flow logs record 5-tuple, bytes, packets and timing without payload, so they survive encryption
2. Beaconing detection: regular intervals and consistent sizes to one destination, allowing for jitter
3. Exfil signals: large outbound byte ratios, new destinations, uploads at unusual hours
4. Zeek adds protocol logs (conn, dns, ssl, http) with JA3/JA4 fingerprints for richer context
5. Baseline east-west traffic so new SMB/RDP/WinRM pairs stand out

If the interviewer pushes back

• How would an attacker blend C2 beacons to defeat interval-based detection?

Go deeper

• attack.mitre.org/techniques/T1071/