A proxy log shows one host calling the same domain every 60 seconds. Triage it and say what is happening.
You are triaging a hunting hit on one workstation. Decide what is happening and what you do next.
Constraints:
- Judge from the evidence shown; do not assume a verdict from the domain name.
- Say explicitly which telemetry you pivot to and why.
ts=10:00:04 src=10.14.7.31 host=cdn-metrics-eu.example.net method=POST bytes_out=812 bytes_in=134 ua=Mozilla/5.0
ts=10:01:05 src=10.14.7.31 host=cdn-metrics-eu.example.net method=POST bytes_out=804 bytes_in=134 ua=Mozilla/5.0
ts=10:02:04 src=10.14.7.31 host=cdn-metrics-eu.example.net method=POST bytes_out=819 bytes_in=134 ua=Mozilla/5.0
ts=10:03:06 src=10.14.7.31 host=cdn-metrics-eu.example.net method=POST bytes_out=808 bytes_in=134 ua=Mozilla/5.0
... 412 further requests, same pattern, over 7 hours, including 01:00-05:00
whois: domain registered 9 days ago category: uncategorisedExplain what the pattern indicates and describe your triage steps.
The near-constant interval with uniform tiny responses is machine periodicity, not human browsing, which is bursty. Confirm by pivoting to EDR for the process and its parent, check the domain's age and reputation, then isolate the host if the process is untrusted.
- ✗Reading a fixed interval as proof of a legitimate updater without checking the process
- ✗Trusting the user-agent string as evidence that a human was driving the traffic
- ✗Reaching a verdict from network logs alone, with no endpoint pivot
- →How would jitter in the interval change your detection approach?
- →Which EDR fields settle whether the calling process is legitimate?
The pattern reads as beaconing, not human activity. Three signals combine: the interval holds near 60 seconds with a couple of seconds of drift, bytes_in is constant (134 bytes — the size of a no tasking reply), and the activity runs from 01:00 to 05:00 when nobody is at the desk. Human traffic is bursty: a cluster of requests, a pause, varied sizes. The Mozilla/5.0 string proves nothing, since the client chooses its own user-agent.
A domain registered nine days ago with no category is corroborating context, not a verdict — legitimate services also use young domains.
Next comes the endpoint pivot, because the network log never names the process:
1. EDR -> network connections from host 10.14.7.31 to cdn-metrics-eu.example.net
2. Take the initiating process: on-disk path, signature, hash, command line
3. Walk up to the parent: what launched it (winword.exe -> powershell.exe is a bad sign)
4. Check persistence: run keys, scheduled tasks, services
5. Widen the search: did any other host contact the same domainIf the process is legitimate and signed (a vendor telemetry agent, say), close the hit and document the baseline. If it is unsigned, running from a user-writable directory, or spawned by an office application, isolate the host from the network, preserve memory and disk, and hand over to incident response.
