Webscout Workshop for Cyber Threat Intelligence Analysts

Agenda

Introduction to the Cases

The following exercises cover important Webscout use cases for Cyber Threat Intelligence (CTI) analysis.

The exercises focus mainly on the Webscout user interface. Programming skills are not required.

All questions can be answered using Webscout. Third-party platforms such as Censys are not required.

Info: Covert network In this workshop, a covert network is infrastructure used to relay traffic and make its original source more difficult to identify. Examples can include proxy services, VPN infrastructure, Tor, and Operational Relay Box (ORB) networks.

Exercise 0: Webscout Basics

This exercise introduces basic searches, log types, Signals, account functions, and the Webscout API.

Hint Review the Flow Search query examples if you are unsure about the available fields or query syntax.

Question 0.1

Which Polish domain under .pl received the highest number of covert network connections during the last 24 hours?

Answer: Search for: domain:*.pl Set the time range to Last 24 hours. Use the results or aggregation view to identify the domain with the highest number of observations. The exact result may change over time.

Question 0.2

Which Polish IP address received the highest number of covert network connections during the last 24 hours?

Answer: Search for: id.resp_h_cc:"PL" Set the time range to Last 24 hours. Identify the destination IP with the highest number of observations.

Question 0.3

Which Polish IP address initiated the highest number of connections to covert networks during the last 24 hours?

Answer: Search for: id.orig_h_cc:"PL" Set the time range to Last 24 hours. Identify the source IP with the highest number of observations.

Question 0.4

Which HTTP user-agent is most frequently observed in connections to Polish domains during the last 24 hours?

Answer: Open Flow Search, select the HTTP log type, and search Polish domains with: *.pl Review the user-agent field and identify the most frequently observed value.

Question 0.5

Which Python scripts, Windows executables, or Bash scripts were successfully downloaded over cleartext HTTP during the past week?

Answer: Search for: uri:(*.sh OR *.py OR *.exe) AND status_code:"200" Set the time range to the previous week. A 200 HTTP status code indicates that the requested object was returned successfully.

Question 0.6

How many emails were sent from Polish email addresses during the past week?

Hint Review SMTP logs and the mailfrom field.

Answer: Filter SMTP records for senders associated with Polish email addresses and set the time range to the previous week. Use the result count to determine the total. The draft does not define a fixed count because the result depends on the current Webscout dataset.

Question 0.7

How many emails were sent to Polish email addresses during the past week?

Answer: Filter SMTP records for recipients associated with Polish email addresses and set the time range to the previous week. Use the result count to determine the total.

Question 0.8

How can you decode an encoded email subject such as the following value?

=?utf-8?B?0KDQsNC30LzQtdGJ0LXQvdC40LUg0L3QsCDQktCw0YjQtdC8INGB0LDQudGC0LUgLSDQn9GA0LXQvNC40LDQu9GM0L3Ri9C5INCh0LvQvtCy0LDRhtC60LjQuSDQutC+0LvQu9Cw0LPQtdC9?=

Info: MIME encoded-word Email headers can contain encoded text in the form =?charset?encoding?data?=. The B indicates Base64 encoding.

Answer: Remove the MIME wrapper and Base64-decode the encoded data using UTF-8. CyberChef can also be used: https://gchq.github.io/CyberChef/#recipe=Find_/_Replace(%7B'option':'Simple%20string','string':'%3D?utf-8?B?'%7D,'',true,false,true,true)From_Base64('A-Za-z0-9%2B/%3D',true,false)&oenc=65001&oeol=VT

Question 0.9

Can you find a Webscout Signal that mentions DYNOWIPER?

Hint Open the Signals section: https://app.webscout.io/signals

Answer: Yes. The draft identifies the Signal: DYNOWIPER: Destructive Wiper Malware Targeting Poland's Energy Infrastructure

Question 0.10

Does the activity associated with the DYNOWIPER Signal appear relevant to Polish CTI requirements?

Answer: Yes, if the observed activity is associated with Polish energy infrastructure or other nationally important systems. Review the affected assets, traffic, and context in the Signal before making an assessment.

Question 0.11

Where can you find the Webscout API documentation?

Answer: https://app.webscout.io/docs/api

Question 0.12

How can you use the Webscout API to look up one IP address?

Answer: Use the IP query endpoint. For example: https://api.webscout.io/query/ip/89.36.76.126

Question 0.13

Where can you configure two-factor authentication for your Webscout account?

Answer: Open the account settings: https://app.webscout.io/account

Question 0.14

How can you provide feedback or submit a feature request?

Answer: Use the feedback mechanism provided in Webscout. The original workshop draft does not specify the exact current workflow, so the instructor should demonstrate the available feedback channel in the platform.

Exercise 1: APT28 Brute-Force Activity and JA4+ Fingerprints

This exercise uses indicators from a public advisory covering APT28 activity against transport and logistics organisations supporting Ukraine.

Reference report:

https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF

You do not need to read the complete report during the exercise. You may copy the indicators of compromise (IoCs) directly from the report.

Info: Indicator of Compromise An Indicator of Compromise, or IoC, is an observable value that may be associated with malicious activity. Examples include IP addresses, domains, file hashes, and network fingerprints.

Part 1A: IP Enrichment Analysis

Question 1.1

Which brute-force source IP addresses listed on page 17 of the report have also been observed by Webscout's covert network sensors?

Hint Copy the IP addresses from the report and use Webscout's bulk selector or drag-and-drop function.

Answer: Import the IP list into Webscout and identify the addresses with Webscout observations.

Question 1.2

Which of the imported IP addresses has the highest number of Webscout observations?

Answer: 207.244.71.84

Question 1.3

Which VPN or proxy service is associated with the Polish IP address 138.199.59.43?

Answer: Private Internet Access.

Part 1B: Covert Network Traffic Analysis

One Webscout sensor observed the following JA4+ fingerprints in traffic associated with the brute-force activity:

t13d121000_a538d02d76d5_5ac7197df9d2

t13d122000_a538d02d76d5_81737722f97c

t13d4312h1_c7886603b240_24695f2957a7

t13i3211h1_b0a840187ebd_8d633dac7124

Info: JA4+ JA4+ is a family of network fingerprints. It describes characteristics of protocol implementations, including TLS client behaviour. It can help analysts group similar network activity even when IP addresses change. Further reading: https://blog.foxio.io/ja4+-network-fingerprinting

Question 1.4

What do these four JA4 fingerprints have in common?

Answer: All four indicate TLS 1.3. This shows that the observed clients support a modern TLS version. TLS 1.3 alone does not prove that the traffic comes from a new or specific attack framework.

Question 1.5

Do these JA4 fingerprints also appear in legitimate traffic?

Answer: Yes. At least some of the fingerprints occur in legitimate traffic, including traffic associated with services such as Netflix. This demonstrates why a JA4 fingerprint should not normally be treated as a malicious indicator without additional context.

Info: False positive A false positive occurs when an indicator or detection method identifies benign activity as suspicious or malicious.

Question 1.6

Which of the four JA4 fingerprints has the highest number of observations across Webscout's covert network traffic?

Answer: t13i3211h1_b0a840187ebd_8d633dac7124

Question 1.7

Has t13i3211h1_b0a840187ebd_8d633dac7124 been observed in connections to identified domains or hostnames?

Answer: No.

Question 1.8

Which Ukrainian server names were most frequently targeted by traffic matching the four JA4 fingerprints?

Hint Search the four JA4 values together and restrict the results to Ukrainian server names: (ja4:"t13d121000_a538d02d76d5_5ac7197df9d2" OR ja4:"t13d122000_a538d02d76d5_81737722f97c" OR ja4:"t13d4312h1_c7886603b240_24695f2957a7" OR ja4:"t13i3211h1_b0a840187ebd_8d633dac7124") AND server_name:*.ua

Answer: The workshop draft records the following results: 1. mail.patrol.police.gov.ua: 43 observations 2. damba.org.ua: 35 observations 3. mail.it.ua: 32 observations 4. mail.police.gov.ua: 30 observations 5. mail.kyivcity.gov.ua: 29 observations 6. mail.gur.gov.ua: 28 observations 7. mail.mod.gov.ua: 27 observations 8. mail-kyiv.gp.gov.ua: count not specified in the draft The original draft does not provide entries 9 and 10. Use the current Webscout aggregation results to complete the top 10 during the exercise.

Question 1.9

What type of systems appear to be a major target of this activity?

Answer: Mail servers. Many of the most frequently observed server names begin with mail and belong to government or other important Ukrainian organisations.

Question 1.10

Which Ukrainian destination IP addresses received the most traffic matching these JA4 fingerprints, and which server names are associated with those IP addresses?

Hint Search for: (ja4:"t13d121000_a538d02d76d5_5ac7197df9d2" OR ja4:"t13d122000_a538d02d76d5_81737722f97c" OR ja4:"t13d4312h1_c7886603b240_24695f2957a7" OR ja4:"t13i3211h1_b0a840187ebd_8d633dac7124") AND id.resp_h_cc:"UA" Then use the aggregation view to examine destination IP addresses and server names.

Answer: Use the aggregation results to identify the most frequently targeted Ukrainian IP addresses and their associated server names. The draft does not provide a fixed top-10 list.

Question 1.11

Is the list produced by server_name:*.ua identical to the list produced by filtering destination IP addresses with id.resp_h_cc:"UA"?

Answer: No.

Question 1.12

Why is the difference between these two lists important for CTI analysis?

Answer: A country-code top-level domain is not a complete method for identifying organisations in a country. A Ukrainian organisation may use .com, .org, or another top-level domain. Analysts should therefore combine domain information with IP geolocation and other attribution data.

Question 1.13

Which additional JA4 fingerprints has Webscout observed in connections to damba.org.ua?

Answer: The workshop draft identifies: t13d1516h2_8daaf6152771_d8a2da3f94cd t13d1516h2_8daaf6152771_02713d6af862 t13d2014h2_a09f3c656075_14788d8d241b t13d3112h1_e8f1e7e78f70_24695f2957a7 t13d2812h2_257f3020b3a2_cbb9361b6bf9

Question 1.14

Which of these additional JA4 fingerprints are most common across Webscout's complete netflow dataset?

Answer: Search the five JA4 values together and compare their observation counts in the aggregation view. The original draft does not specify the final ranking.

Question 1.15

Have the two rare fingerprints ending in a7 and f9 also been observed targeting Polish infrastructure?

The two fingerprints are:

t13d3112h1_e8f1e7e78f70_24695f2957a7

t13d2812h2_257f3020b3a2_cbb9361b6bf9

Answer: Yes. One example is: poczta.strazgraniczna.pl A suitable search is: ja4:("t13d3112h1_e8f1e7e78f70_24695f2957a7" OR "t13d2812h2_257f3020b3a2_cbb9361b6bf9") AND server_name:*.pl

Question 1.16

Can Webscout observations reveal an upstream source associated with some of this traffic before it passes through a covert proxy?

Info: SOCKS5 SOCKS5 is a proxy protocol that allows a client to send network connections through another system. TCP port 1080 is commonly associated with SOCKS proxy services.

Hint Look for connections involving TCP port 1080. Then correlate the relevant flow records.

Answer: In some cases, yes. If Webscout observes the connection into a SOCKS5 proxy as well as the connection leaving it, the analyst may be able to identify the source visible before the proxy hop. For these rare JA4 fingerprints, investigate traffic similar to: ja4:("t13d3112h1_e8f1e7e78f70_24695f2957a7" OR "t13d2812h2_257f3020b3a2_cbb9361b6bf9") AND id.resp_p:1080 AND server_name:*mail* This can reveal an upstream network source. It should not automatically be treated as the attacker's true endpoint.

Question 1.17

How can you create an alert when either of these rare JA4 fingerprints targets Polish infrastructure?

Hint Use the Webscout Save function after building the search.

Answer: Create and save a search such as: ja4:("t13d3112h1_e8f1e7e78f70_24695f2957a7" OR "t13d2812h2_257f3020b3a2_cbb9361b6bf9") AND (server_name:*.pl OR id.resp_h_cc:"PL") Configure the saved search for alerting according to the available Webscout options.

Exercise 2: VOID BLIZZARD Zimbra Phishing and Exploitation

This exercise uses indicators associated with VOID BLIZZARD, also known as LAUNDRY BEAR.

Reference advisory:

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a

You do not need to read the complete advisory during the exercise. You may copy the IoCs directly into Webscout.

Part 2A: IP Enrichment Analysis

Question 2.1

Which IP addresses from the advisory have been observed by Webscout's covert network sensors?

Use the following IP addresses:

216.252.238.104

216.252.238.18

37.120.247.228

185.86.79.95

104.248.134.194

64.226.124.190

193.238.152.66

216.252.238.64

194.156.103.193

Answer: Import the complete list into Webscout's selector and identify the IP addresses with recorded observations.

Question 2.2

Which IP address has the highest number of observations?

Answer: Sort the results by the Observations column. The draft does not specify a fixed IP because the result should be determined from the Webscout dataset during the exercise.

Part 2B: Covert Network Traffic Analysis

DNS Analysis

Info: DNS A record A DNS A record maps a domain name to an IPv4 address.

Question 2.3

For which DNS queries have the VOID BLIZZARD IP addresses appeared as A record answers?

Answer: Open the DNS logs for the IP addresses and inspect the query field.

Question 2.4

Which DNS resolvers or nameservers were involved in these observations?

Answer: Inspect the id.resp_h field in the relevant DNS records.

Question 2.5

Are the observed domains the same as the domains listed in the CISA advisory?

Answer: Compare the domains observed in Webscout with those in the advisory. Record any additional domains separately because they may provide new investigative leads.

SOCKS5 Analysis

Question 2.6

How many SOCKS5 connections has Webscout observed to or from the VOID BLIZZARD IP addresses?

Hint TCP port 1080 is commonly associated with SOCKS proxy services.

Answer: Filter connections involving the VOID BLIZZARD IP addresses and port 1080. Use the result count to determine the number of observed SOCKS5 connections.

Question 2.7

Which IP address appears to be operating the SOCKS5 server?

Hint Identify which endpoint is receiving connections on the SOCKS-associated port.

Answer: Identify the destination endpoint using port 1080. The workshop draft does not provide the final server IP explicitly.

Question 2.8

Which IP address is initiating the connection to the SOCKS5 server?

Answer: 77.90.4.130

Question 2.9

What type of connection is the Germany-based IP address 77.90.4.130 attempting to create through the SOCKS5 service?

Answer: SSH connections.

Question 2.10

Are the SOCKS5 connections and the underlying SSH connections successful?

Info: UID A uid is a connection identifier that can be used to correlate records for the same network activity across different log types.

Answer: The SOCKS5 connections are successful, but the underlying SSH sessions are not. Pivot on: CKXUPN2heD2XpLtnFl CZ9qpA4bGJzmjh9FE5 A suitable search is: uid:"CKXUPN2heD2XpLtnFl" OR uid:"CZ9qpA4bGJzmjh9FE5" The SSH records show auth_success as false or unset. Connection logs also show short sessions with approximately 2.5 KB transferred in each direction, which is consistent with unsuccessful SSH authentication.

Question 2.11

Do both requested hosts appear to run the same SSH server implementation?

Answer: No. The SSH server banners differ. One observation shows: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 Another shows: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u10

Question 2.12

What other behaviour does 77.90.4.130 show in Webscout's covert network data?

Hint Search for: id.orig_h:"77.90.4.130"

Answer: Review the protocol, destination, and log-type distribution for traffic originating from 77.90.4.130. The original draft does not provide a single fixed conclusion for this question. The purpose is to practise pivoting from one observed behaviour to the wider activity of the same IP address.

SSH Analysis

Question 2.13

How many SSH connections has Webscout observed from its covert network sensors to the VOID BLIZZARD IP addresses?

Answer: Filter the traffic for SSH records where the VOID BLIZZARD addresses are the destination. Use the result count to determine the total.

Question 2.14

How many SSH connections has Webscout observed from the VOID BLIZZARD IP addresses to its covert network sensors?

Answer: Reverse the connection direction and count SSH records where the VOID BLIZZARD addresses are the source.

Question 2.15

Which SSH client implementations are most frequently observed, from most to least common?

Answer: The workshop draft records: 1. SSH-2.0-libssh_0.9.6: 12 observations 2. SSH-2.0-AsyncSSH_2.23.0: 2 observations 3. SSH-2.0-paramiko_3.5.0: 2 observations 4. SSH-2.0-paramiko_2.11.1: 1 observation 5. SSH-2.0-paramiko_3.4.0: 1 observation

Question 2.16

How many of the observed SSH sessions were successfully authenticated?

Answer: Four. Filter the relevant SSH records with: auth_success:"true"

Question 2.17

What evidence suggests that some of the SSH connections may have been generated by similar tooling?

Answer: Multiple sessions use Paramiko-based SSH client banners. Shared Paramiko use suggests a similar tooling stack, but it does not by itself prove that the connections came from the same physical or virtual host.

Question 2.18

How long was the longest successful SSH session?

Answer: Approximately 27.3 seconds.

Question 2.19

What is unusual about the longest SSH session, and what can you infer from it?

Answer: The session transferred considerably more data than the shorter connections. This is consistent with activity beyond a simple failed authentication attempt and may indicate a data transfer. The direction and content of the transfer should be checked before concluding that a file was downloaded.

Question 2.20

Can Webscout identify the true originating IP address of the successful SSH connections?

Answer: No. The observed source is a Tor exit node monitored by Webscout. This means Webscout can identify the exit infrastructure visible to the sensor, but not necessarily the original client behind Tor.

Question 2.21

Do the timestamps of the successful SSH connections observed by Webscout match the activity period described in the CISA advisory?

Answer: No. According to the workshop draft, the CISA-described activity occurred later than the successful connections observed by Webscout.

Question 2.22

Does this timing difference prove that the actor did not control the infrastructure when Webscout observed the earlier connections?

Answer: No. An actor may control or prepare infrastructure before it is used in the activity later documented in a public advisory. The timing difference reduces certainty but does not rule out earlier actor control.

Exercise 3: Continuous Monitoring of Polish Critical Infrastructure

The objective of this exercise is to build a Webscout dashboard for covert network traffic to and from critical infrastructure in Poland.

Info: Critical infrastructure Critical infrastructure includes systems, organisations, and services whose disruption could have a serious effect on national security, public safety, the economy, or essential government functions.

Question 3.1

Which sectors should be represented in a dashboard monitoring Polish critical infrastructure?

Answer: Participants should identify sectors based on national importance and operational dependency. Examples can include energy, ports, transport, telecommunications, government services, and other essential services.

Question 3.2

Which organisations should be included for each selected critical infrastructure sector?

Answer: Identify organisations that have significant national importance, provide essential services, or create a substantial impact if disrupted. Use publicly verifiable information only.

Question 3.3

Which publicly attributable domains belong to the selected organisations?

Answer: Identify official corporate, operational, service, or business-platform domains. Do not guess internal infrastructure or domains that cannot be verified through public sources.

Hint The following prompt can be used to help prepare candidate organisations and domains. All results should still be verified before they are added to monitoring.

You are a cybersecurity analyst supporting Poland's national cybersecurity authorities.

Which 5 to 10 organisations are most critical to the {SECTORNAME} sector in Poland, based on national importance, service dependency, market role, and the potential impact of disruption to essential services?

For each organisation, provide a table containing:

1. What is the organisation's official name?
2. Why is the organisation important to this sector?
3. What are its primary publicly attributable organisational domains?
4. Which domains can be verified through reliable public sources?
5. If the organisation uses several official domains, which are most relevant to its operations?

Prioritise official corporate, operational, service, or business-platform domains over marketing and campaign websites.

Do not infer, guess, or enumerate non-public or internal infrastructure.

After verifying the domains, produce one Webscout query in exactly this format:

domain:(*.entity1.com OR entity1.com OR *.entity2.com OR entity2.com OR ...)

Do not include duplicate domains, URL paths, protocols such as https://, or unrelated subsidiaries unless they are independently critical to the sector.

Provide the consolidated domain:(...) query on a separate final line.

Question 3.4

How can you combine the verified domains into one Webscout query?

Answer: Use the following format: domain:(*.entity1.com OR entity1.com OR *.entity2.com OR entity2.com OR ...) Include both the root domain and wildcard subdomain form where appropriate.

Question 3.5

How can you use the combined query to create continuous Webscout monitoring for the selected Polish infrastructure?

Answer: Run the consolidated query, select the fields and aggregations useful for CTI monitoring, and save the resulting view or search using Webscout's monitoring functions. The dashboard should make it easy to identify unusual source infrastructure, targeted organisations, protocols, and changes in activity over time.

Exercise 4: Determining Whether a Honeypot Has Joined an ORB Network

APT28 has been reported using compromised Cisco RV130 routers as relay infrastructure. To gain visibility into similar activity, a Cisco RV130 router has been deployed with a Polish ISP where relevant infrastructure has previously been observed.

For this exercise, the router IP address is:

46.22.165.31

Info: Operational Relay Box An Operational Relay Box, or ORB, is an intermediary system used to relay operational traffic. Threat actors can build ORB networks from compromised routers, VPN devices, servers, or other internet-facing systems. ORBs make it more difficult to identify the actor's original infrastructure.

Info: Honeypot A honeypot is a deliberately exposed system or service used to observe potentially malicious activity. It should be isolated and monitored so that it does not create unnecessary risk to other systems.

Question 4.1

Does the available Webscout traffic indicate that 46.22.165.31 has been compromised and is being used as a proxy or ORB?

Hint The Webscout sensor is deployed on the router itself. Compare inbound traffic to: id.resp_h:"46.22.165.31" with outbound traffic from: id.orig_h:"46.22.165.31"

Answer: The workshop draft concludes that there is no strong evidence that the router is currently being used as an adversary-controlled proxy. Investigate outbound TCP activity with: id.orig_h:"46.22.165.31" AND NOT id.resp_h:"46.22.165.31" AND proto:"tcp" AND conn_state:("SF" OR "S1" OR "S0") Review the connection state carefully. S0 represents a connection attempt without a completed TCP handshake, so it should not be treated as evidence of a successful outbound connection.

Question 4.2

What is the distribution between inbound and outbound connections involving 46.22.165.31?

Answer: Compare: id.resp_h:"46.22.165.31" with: id.orig_h:"46.22.165.31" Use the counts and time distribution to understand whether the device mainly receives traffic or also initiates connections.

Question 4.3

What does the observed outbound traffic suggest about whether the router is operating as part of an ORB network?

Answer: Look for established outbound connections that could represent relayed client traffic. If the router receives suspicious inbound traffic but does not create corresponding successful outbound sessions, there is less evidence that it is functioning as an active relay.

Question 4.4

Has the router completed outbound connections to any Polish organisations?

Answer: Filter outbound connections from 46.22.165.31 and identify Polish destination IP addresses or server names. Focus on established connections rather than connection attempts.

Question 4.5

On which days does the Webscout data indicate that the router may have been offline?

Answer: Review the observation timeline and identify periods with no sensor traffic. Treat an absence of traffic carefully. A gap can indicate that the router was offline, but it can also result from a sensor, collection, or connectivity problem.

Exercise 5: Requesting Bespoke Visibility

Webscout can provide bespoke network visibility for selected partners who require additional information about a specific covert network.

This can include questions such as how a network is growing, who is using it, and which organisations are being targeted.

Info: RFI RFI means Request for Information. It is a structured request for additional collection, analysis, or intelligence support.

Question 5.1

How can you request special collection or bespoke visibility into a new ORB or proxy network?

Answer: Submit the request through either: 1. The Webscout RFI module. 2. The Signal chat function.

Exercise 6: Connecting Your Own Sensors

Some Webscout partners may want to analyse traffic from their own national sensors, lawful collection systems, or network taps together with Webscout's covert network observations.

The objective is to make partner-provided traffic searchable and correlatable in the same analytical environment.

Question 6.1

How can your organisation connect its own netflow data to Webscout so that analysts can hunt and correlate it with Webscout's covert network traffic?

Answer: Use Webscout's partner data or sensor integration process to onboard the organisation's network-flow data. The original draft does not specify the exact technical onboarding procedure. The instructor should demonstrate the current Webscout integration workflow during the workshop.

Question 6.2

Will network-flow data provided by your organisation become visible to other Webscout partners?

Answer: No. According to the workshop material, connected partner data is available only to the organisation that provided it.