TLP:RED // RESTRICTED // FOR PLN-WEBSCOUT EYES ONLY

Webscout PL CYBER Workshop

Agenda

Introduction to the Cases

The following exercises cover important Webscout use cases for Cyber Threat Intelligence (CTI) analysis.

The exercises focus mainly on the Webscout user interface. Programming skills are not required.

All questions can be answered using Webscout. Third-party platforms such as Censys are not required.

Info: Covert network In this workshop, a covert network is infrastructure used to relay traffic and make its original source more difficult to identify. Examples can include proxy services, VPN infrastructure, Tor, and Operational Relay Box (ORB) networks.

Exercise 1: Webscout Basics

This exercise introduces basic searches, log types, Signals, account functions, and the Webscout API.

Hint Review the Flow Search query examples if you are unsure about the available fields or query syntax.

Question 1.1

Which domain under the .pl TLD received the highest number of covert network connections during the last 24 hours, according to the SSL log?

Question 1.2

Which Polish IP address received the highest number of covert network connections during the last 24 hours?

Hint Look for the relevant geo field.

Question 1.3

Which Polish IP address initiated the highest number of connections to covert networks during the last 24 hours? (Assume that all responding hosts are covert network nodes)

Question 1.4

Which HTTP user-agent is most frequently observed in connections to Polish domains during the last 24 hours?

Hint Try hovering the relevant column in the http log.

Question 1.5

Which Python scripts, Windows executables, or Bash scripts were successfully downloaded over cleartext HTTP during the past week?

Hint Use wildcards in the URI selector, for instance: *.py

Question 1.6

How many emails were sent from Polish email addresses during the past week?

Hint Review SMTP logs and the mailfrom field.

Question 1.7

How many emails were sent to Polish email addresses during the past week?

Hint Review SMTP logs and the rcptto field.

Question 1.8

How can you decode and translate an encoded email subject such as the following value?

=?utf-8?B?0KDQsNC30LzQtdGJ0LXQvdC40LUg0L3QsCDQktCw0YjQtdC8INGB0LDQudGC0LUgLSDQn9GA0LXQvNC40LDQu9GM0L3Ri9C5INCh0LvQvtCy0LDRhtC60LjQuSDQutC+0LvQu9Cw0LPQtdC9?=

Info: MIME encoded-word Email headers can contain encoded text in the form =?charset?encoding?data?=. The B indicates Base64 encoding.

Hint Remove the MIME wrapper and Base64-decode the encoded data using UTF-8. CyberChef can also be used: https://gchq.github.io/CyberChef/#recipe=Find_/_Replace(%7B'option':'Simple%20string','string':'%3D?utf-8?B?'%7D,'',true,false,true,true)From_Base64('A-Za-z0-9%2B/%3D',true,false)&oenc=65001&oeol=VT

Question 1.9

Can you find a Webscout Signal that mentions DYNOWIPER?

Hint Open the Signals section: `` https://beta.webscout.io/signals ``

Question 1.10

Do any of the IoCs from the DYNOWIPER Signal from Elastic Security have hits in Webscout's Covert Network Sources?

Question 1.11

Where can you find the Webscout API documentation?

Question 1.12

How can you use the Webscout API to look up one IP address?

Hint Look in the Authentication segment and/or the IP lookup section under the API in the left-hand panel.

Question 1.13

Where can you configure two-factor authentication for your Webscout account?

Hint Find the Security tab under Settings.

Question 1.14

How can you provide feedback or submit a feature request?

Exercise 2: APT28 Brute-Force Activity and JA4+ Fingerprints

This exercise uses indicators from a public advisory covering APT28 activity against transport and logistics organisations supporting Ukraine.

Reference report:

https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF

You do not need to read the complete report during the exercise. You may copy the indicators of compromise (IoCs) directly from the report.

Info: Indicator of Compromise An Indicator of Compromise, or IoC, is an observable value that may be associated with malicious activity. Examples include IP addresses, domains, file hashes, and network fingerprints.

Part 2A: IP Enrichment Analysis

Question 2.1

Which brute-force source IP addresses listed on page 17 of the report have also been observed by Webscout's covert network sensors?

Hint Copy the IP addresses from the report and use Webscout's bulk selector or drag-and-drop function.

Question 2.2

Which of the imported IP addresses has the highest number of Webscout observations?

Question 2.3

Which VPN or proxy service is associated with the Polish IP address 95.215.76.209? Are there more than one?

Hint Look in the "Anonymization" column. Even better, open the IP in the selector view.

Part 2B: Covert Network Traffic Analysis

One Webscout sensor observed the following JA4+ fingerprint in traffic associated with the brute-force activity:

t13d4312h1_c7886603b240_24695f2957a7

Info: JA4+ JA4+ is a family of network fingerprints. It describes characteristics of protocol implementations, including TLS client behaviour. It can help analysts group similar network activity even when IP addresses change. Further reading: `` https://blog.foxio.io/ja4+-network-fingerprinting ``

For this part of the exercise, set your time range to All time.

Question 2.4

How do you read a JA4 fingerprint, and what can be determined directly from the structure of t13d4312h1_c7886603b240_24695f2957a7?

Hint Try opening it in a selector search.

Question 2.5

Does this JA4 fingerprint also appear in legitimate traffic?

Info: False positive A false positive occurs when an indicator or detection method identifies benign activity as suspicious or malicious.

Question 2.6

How many observations in total does this JA4 fingerprint have?

Question 2.7

Has t13d4312h1_c7886603b240_24695f2957a7 been observed in connections to identified domains or hostnames?

Question 2.8

Which Ukrainian server names were most frequently targeted by traffic matching the JA4 fingerprint?

Hint Restrict the results to Ukrainian server names: `` ja4:"t13d4312h1_c7886603b240_24695f2957a7" AND server_name:*.ua ``

Question 2.9

What type of systems appear to be a major target of this activity?

Hint Consider the functional category of the targeted hosts. Database systems? Authentication systems? Mail systems?

Question 2.10

Which additional JA4 fingerprints has Webscout observed in connections to damba.org.ua?

Hint Search for the domain, then find the relevant field and click unique values: `` server_name:"damba.org.ua" ``

Question 2.11

Which of these additional JA4 fingerprints are most common across the Covert Network traffic currently searchable within Webscout?

Question 2.12

Have the two fingerprints ending in a7 and f9 also been observed targeting Polish infrastructure?

The two fingerprints are:

t13d3112h1_e8f1e7e78f70_24695f2957a7
t13d2812h2_257f3020b3a2_cbb9361b6bf9

Hint Search for: `` (ja4:"t13d3112h1_e8f1e7e78f70_24695f2957a7" OR ja4:"t13d2812h2_257f3020b3a2_cbb9361b6bf9") AND domain:*.pl ``

Question 2.13

Can Webscout observations reveal an upstream source associated with some of this traffic before it passes through a covert proxy?

Info: SOCKS5 SOCKS5 is a proxy protocol that allows a client to send network connections through another system. TCP port 1080 is commonly associated with SOCKS proxy services.

Hint Construct a query using the two JA4 fingerprints observed in connections with port 1080.

Question 2.14

How can you create an alert when either of these JA4 fingerprints targets Polish infrastructure?

Hint Use the Webscout Add to watchlist function after building the search.

Exercise 3: Continuous Monitoring of Polish Critical Infrastructure

The objective of this exercise is to build a Webscout dashboard for covert network traffic to and from critical infrastructure in Poland.

Info: Critical infrastructure Critical infrastructure includes systems, organisations, and services whose disruption could have a serious effect on national security, public safety, the economy, or essential government functions.

Question 3.1

Which sectors should be represented in a dashboard monitoring Polish critical infrastructure?

Question 3.2

Which organisations should be included for each selected critical infrastructure sector?

Question 3.3

Which publicly attributable domains belong to the selected organisations?

Hint The following prompt can be used to help prepare candidate organisations and domains. All results should still be verified before they are added to monitoring. `` You are a cybersecurity analyst supporting Poland's national cybersecurity authorities. Which 5 to 10 organisations are most critical to the {SECTORNAME} sector in Poland, based on national importance, service dependency, market role, and the potential impact of disruption to essential services? For each organisation, provide a table containing: 1. What is the organisation's official name? 2. Why is the organisation important to this sector? 3. What are its primary publicly attributable organisational domains? 4. Which domains can be verified through reliable public sources? 5. If the organisation uses several official domains, which are most relevant to its operations? Prioritise official corporate, operational, service, or business-platform domains over marketing and campaign websites. Do not infer, guess, or enumerate non-public or internal infrastructure. After verifying the domains, produce one Webscout query in exactly this format: domain:(*.entity1.com OR entity1.com OR *.entity2.com OR entity2.com OR ...) Do not include duplicate domains, URL paths, protocols such as https://, or unrelated subsidiaries unless they are independently critical to the sector. Provide the consolidated domain:(...) query on a separate final line. ``

Question 3.4

How can you combine the verified domains into one Webscout query?

Question 3.5

How can you use the combined query to create continuous Webscout monitoring for the selected Polish infrastructure?

Exercise 4: VOID BLIZZARD Zimbra Phishing and Exploitation

This exercise uses indicators associated with VOID BLIZZARD, also known as LAUNDRY BEAR.

Reference advisory:

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a

You do not need to read the complete advisory during the exercise. You may copy the IoCs directly into Webscout.

Part 4A: IP Enrichment Analysis

For this part of the exercise, set the time limit to Last 12 months.

Question 4.1

Which IP addresses from the advisory have been observed by Webscout's covert network sensors?

Use the following IP addresses:

216.252.238.104
216.252.238.18
37.120.247.228
185.86.79.95
104.248.134.194
64.226.124.190
193.238.152.66
216.252.238.64
194.156.103.193

Question 4.2

Which IP address has the highest number of observations across our Covert Netflows?

Part 4B: Covert Network Traffic Analysis

DNS Analysis

Info: DNS A record A DNS A record maps a domain name to an IPv4 address.

Question 4.3

Have any of the VOID BLIZZARD IP addresses appeared as DNS A record answers? Which domain(s) was being queried?

Question 4.4

Which name server or name servers were being queried?

Question 4.5

Do any of these domains appear in the CISA advisory?

SOCKS5 Analysis

Question 4.6

How many SOCKS5 connections has Webscout observed to or from the VOID BLIZZARD IP addresses over the past year?

Hint TCP port 1080 is commonly associated with SOCKS proxy services.

Question 4.7

Which IP address appears to be hosting the SOCKS5 server?

Hint Which IP has the SOCKS-associated port open?

Question 4.8

Which IP address is initiating the connection to the SOCKS5 server?

Question 4.9

What type of connection is the Germany-based IP address 77.90.4.130 attempting to create through the SOCKS5 service?

Question 4.10

Are the SOCKS5 connections and the underlying SSH connections successful?

Info: UID A uid is a connection identifier that can be used to correlate records for the same network activity across different log types.

Question 4.11

Do both of the hosts that the german IP is trying to SSH into appear to run the same SSH server?

Question 4.12

What other behaviour does 77.90.4.130 show in Webscout's covert network data?

Hint Search for: `` ip:("77.90.4.130") ``

SSH Analysis

For this part of the exercise, set the time limit to All time.

Question 4.13

How many SSH sessions has Webscout observed from the VOID BLIZZARD IP addresses?

Question 4.14

Which SSH client implementations are most frequently observed, from most to least common?

Hint Try hovering the relevant column in the SSH log.

Question 4.16

How many of the observed SSH sessions were successfully authenticated?

Hint Is there a relevant column name to narrow down successful attempts?

Question 4.17

What evidence suggests that some of the SSH connections may have been generated by similar tooling?

Question 4.18

How long was the longest successful SSH session?

Hint The conn log holds duration. Couple that with the relevant field.

Question 4.19

What is unusual about the longest SSH session, and what can you infer from it?

Question 4.20

Can Webscout identify the true originating IP address of the successful SSH connections?

Question 4.21

Do the timestamps of the successful SSH connections observed by Webscout match the activity period described in the CISA advisory?

Question 4.22

Does this timing difference prove that the actor did not control the infrastructure when Webscout observed the earlier connections?

Exercise 5: Determining Whether a Honeypot Has Joined an ORB Network

APT28 has been reported using compromised Cisco RV130 routers as relay infrastructure. To gain visibility into similar activity, a Cisco RV130 router has been deployed with a Polish ISP where relevant infrastructure has previously been observed.

For this exercise, the router IP address is:

46.22.165.31

Info: Operational Relay Box An Operational Relay Box, or ORB, is an intermediary system used to relay operational traffic. Threat actors can build ORB networks from compromised routers, VPN devices, servers, or other internet-facing systems. ORBs make it more difficult to identify the actor's original infrastructure.

Info: Honeypot A honeypot is a deliberately exposed system or service used to observe potentially malicious activity. It should be isolated and monitored so that it does not create unnecessary risk to other systems.

Question 5.1

Does the available Webscout traffic indicate that 46.22.165.31 has been compromised and is being used as a proxy or ORB?

Hint The Webscout sensor is deployed on the router itself. Compare inbound and outbound traffic. Connection states matter: conn_state:("SF" OR "S1" OR "S0")

Question 5.2

What does the observed outbound traffic suggest about whether the router is operating as part of an ORB network?

Question 5.3

Has the router completed outbound connections to any Polish organisations?

Question 5.4

On which days does the Webscout data indicate that the router may have been offline?