Beacon Hunt: Find It, Prove It, Kill It — Don't Break the Business

Your netflow sensor screamed overnight: this production box — running the corp storefront (webapp) — made ~20,000 outbound connection attempts to one external IP, but the EDR agent on the same box logged almost nothing. First responders captured a process snapshot (/root/triage/ps.txt) before handing you the box. Something is beaconing, the security tool is nearly blind to it, and the storefront still has to be serving customers when you're done.

Work it like a responder — hunt, prove, eradicate — and record your findings in two files under /root/case:

• /root/case/findings.txt — your own write-up (free text): the rogue binary's full path, what its package-ownership check showed, and your explanation of the telemetry gap. Quote the specific lines that incriminate it, but don't paste whole evidence files in — a raw dump isn't a finding.
• /root/case/c2.txt — just the C2 IP address.

The EDR log is /var/log/edr/agent.log; the netflow log is /var/log/netwatch/flows.log.

1. Hunt the beacon in the captured snapshot. Trust ground truth (its on-disk binary, its package ownership), not the name it advertises.

2. Prove the C2 by making independent sources agree — the snapshot's process arguments, the binary itself, and the netflow log.

3. Explain the telemetry gap: why the EDR saw ~3 events while netwatch saw ~20,000 flows.

4. Eradicate the dropped binary — delete it, and leave the legit storefront binary (/usr/local/bin/webapp) untouched.

5. Remove both persistence mechanisms so a reboot can't revive it.

Grading checks the evidence you record, the binary you remove, the persistence you remove, and that the legitimate storefront binary is still there.