Threat Hunting Exercise: Analyzing Proxy Newly-Registered-Domain Beaconing Dataset
This hunt uses a simulated web proxy dataset (proxy_nrd_beacon_2022-04-30T080000.json) capturing T1071.001: Web Protocols and T1583.001: Acquire Infrastructure - Domains, where an implant beacons to a domain registered within the last 7 days - a classic C2 infrastructure pattern that predates DNS reputation blocklists catching up.
Step 1: Hypothesis Formation
Hypothesis: A host repeatedly contacts a domain whose WHOIS creation date is within 7 days of first observed traffic, over HTTPS, with regular request intervals and minimal referrer/user-navigation context (no prior search-engine referral, no bookmark pattern) - indicating malware-driven access rather than a user browsing to a new site. Indicators:
- Proxy logs: repeated GET/POST to a single newly-registered domain (NRD), consistent request interval.
- WHOIS/domain-age enrichment: creation date < 7 days before first contact.
- No HTTP referrer header, or referrer is the domain itself (direct/programmatic access pattern).
- Category/reputation engine shows "uncategorized" or "newly observed" rather than an established content category.
Null Hypothesis: A user legitimately clicked a link (e.g., from a promotional email) to a newly-launched vendor site. Invalidate by checking for corroborating email/click-through logs and by confirming request regularity inconsistent with human browsing (fixed-interval automated requests vs. organic page-load bursts).
Rationale: NRDs are disproportionately used for short-lived C2 and phishing infrastructure since domain-reputation systems have not yet built a history; this hunt validates whether domain-age enrichment on proxy logs is a high-signal, low-noise hunting lead.
Step 2: Data Sources and Scope
- Sources: Web proxy logs (Zscaler/Bluecoat-style); passive DNS/WHOIS enrichment feed; Email gateway logs (for null-hypothesis cross-check).
- Scope: ~2022-04-30T08:00:00-16:00:00 UTC; Host: WKS-HR-009 (10.60.3.44); Domain: secure-doc-portal-verify[.]com (registered 2022-04-24).
- SIEM Queries (Splunk/ELK):
- NRD contact:
index=proxy | lookup domain_age_lookup domain OUTPUT creation_date | where creation_date > relative_time(_time, "-7d") - Interval regularity:
index=proxy dest_domain="secure-doc-portal-verify.com" | delta _time as gap | stats avg(gap), stdev(gap) - Referrer check:
index=proxy dest_domain="secure-doc-portal-verify.com" | stats values(http_referrer)
Step 3: Key Findings
Parsed events (7 shown) confirm 61 proxy requests to a 6-day-old domain at a regular ~8-minute interval, with no legitimate referrer.
| Timestamp (UTC) | Host | Domain | Method | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-04-30 08:03:11 | WKS-HR-009 | secure-doc-portal-verify[.]com | POST /check | Age IOC: domain registered 6 days prior - well within the high-risk NRD window. |
| 2022-04-30 08:11:22 | WKS-HR-009 | secure-doc-portal-verify[.]com | POST /check | 8m11s gap - matches subsequent intervals almost exactly. |
| 2022-04-30 08:19:40 | WKS-HR-009 | secure-doc-portal-verify[.]com | POST /check | Third request, same interval - regularity building. |
| - | WKS-HR-009 | (all requests) | N/A | Referrer IOC: zero requests carry a browser referrer header consistent with organic navigation (search engine, email link) - all requests are direct POSTs typical of a background process, not user clicks. |
| - | WKS-HR-009 | (email gateway) | N/A | Null-hypothesis check: no email in the gateway logs references this domain - rules out the "user clicked a promo link" explanation. |
| 2022-04-30 09:45:00 | WKS-HR-009 | secure-doc-portal-verify[.]com | POST /check (larger body) | One request with a payload ~15x larger than baseline - likely data staged for exfil or a tasking response. |
| 2022-04-30 16:00:00 | WKS-HR-009 | secure-doc-portal-verify[.]com | (summary) | 61 total requests over 8 hours, average interval 7m54s, stdev 22s - statistical regularity inconsistent with human browsing. |
Validation:
- Timeline: Beaconing begins shortly after workstation login and continues throughout the business day at machine-precision intervals.
- False Positives: Email gateway cross-check found no legitimate referring campaign; category engine confirms "uncategorized/newly observed," further reducing benign-site likelihood.
- Correlation: Single host, single domain, tight interval clustering - consistent with a single active implant rather than shared/multi-user traffic.
Step 4: Recommendations & Next Steps
- Immediate Response: Block secure-doc-portal-verify[.]com at proxy/DNS; isolate WKS-HR-009; pull EDR telemetry to identify the beaconing process and its delivery vector (likely a recent phishing attachment or drive-by).
- Detection: Sigma-style rule:
title: Beaconing to Newly-Registered Domain→selection: domain_age < 7d AND request_interval_stdev < 10% of mean AND referrer_absent=true- integrate WHOIS/domain-age enrichment directly into the proxy SIEM pipeline. - Pro Tip: Domain-age enrichment is one of the highest-signal, lowest-effort additions to a proxy hunting program - most legitimate corporate traffic goes to domains that are months or years old; treat any regular, referrer-less traffic to a sub-30-day-old domain as an immediate investigative priority.
Hypothesis confirmed - automated, regular-interval beaconing to a 6-day-old newly-registered domain with no legitimate referral path!