Sources for post-infection PCAP (C2 beaconing, exfiltration) - what am I missing?
Source Reddit BlueTeam
Discussion
This entry discusses the challenge of obtaining publicly available post-infection network traffic captures (PCAPs) showing command-and-control (C2) beaconing and data exfiltration from compromised hosts. While pre-infection traffic sources such as malware delivery URLs and exploit attempts are readily accessible, sustained post-infection traffic captures are scarce or limited to older datasets, small-scale analyst investigations, or short sandbox runs. The community-driven abuse.ch platform provides extensive threat intelligence but does not currently offer continuous post-infection PCAP data. The discussion highlights the difficulty in sourcing long-duration post-infection captures for research and detection development.
r/blueteamsec (opens in a new tab)u/khbjane0 points0 comments
Been going in circles on this and want to check whether there's something obvious I've overlooked.
Pre-infection traffic is easy to collect. URLhaus gives you live malware delivery URLs daily, a honeypot gives you scanning, brute force and exploit attempts. Both free, both refresh constantly, both self-labeling.
Post-infection is where I'm stuck. C2 beaconing and exfiltration only exist if there's an actually compromised host emitting traffic, and nobody publishes captures of that at any useful cadence.
What I've checked so far:
- abuse.ch across all platforms. Indicators only, no traffic. Feodo Tracker is empty post-Endgame. SSLBL cert and C2 IP lists are current and useful as labels but aren't packets. Sandnet exists behind the commercial feed but the dataset description says signals and metadata, contextual data only, so flow records rather than PCAP.
- CTU/MCFP. Real long-duration captures with actual beaconing, which is exactly right, but new botnet captures stop around 2018. Recent directory timestamps are reprocessing, not new data.
- malware-traffic-analysis.net. Best labels anywhere and current, includes a few FTP and SMTP exfiltration cases. Small volume by nature, it's one analyst posting individual investigations.
- Sandboxes. Triage free researcher tier gives API access with PCAPNG including decrypted TLS. ANY.RUN needs a paid tier for bulk. Both are short runs so you get the initial check-in rather than sustained beaconing.
- Running my own detonation. Ruled out. Normal hosting AUPs prohibit it and the ones that don't are bulletproof hosts, which isn't somewhere I'm willing to source data from.
So the question. Is there a source I'm not aware of, or is the honest answer that post-infection traffic just isn't publicly available and everyone working on this either has institutional telemetry or a sandbox subscription?
Also curious whether anyone has found a way to get sustained beaconing rather than just registration out of a commercial sandbox. Long-run options seem rare.