« Phase 08

Lab 02 — C2 Malleable Profile Analyzer

Cedar Lattice, Phase 08. The Cedar Lattice engagement recovered a synthetic representation of the FIN-LATTICE C2 profile — the configuration that controls every observable of their beacon's network communication. Your job: score the profile for default indicators, enumerate redirector gaps, enumerate what a well-instrumented SOC could have detected, and recommend the single highest-impact mitigation.

Safety. This lab analyzes synthetic profile metadata only. No working C2 profile is produced, deployed, or functional. All analysis is over Python dicts representing profile fields.

Learning Objectives

By completing this lab you can:

1. Enumerate the six observable categories of a C2 malleable profile and name the default value for each.
2. Implement a noise-score function that counts default/known-bad indicators in a profile dict.
3. Enumerate redirector-configuration gaps (missing mitigations) from profile metadata.
4. Generate a detection-opportunity list from a profile — what a blue team with full visibility could have caught.
5. Implement a priority-ordered best-mitigation recommendation.
6. Explain why a noise score of 0 does not mean the profile is undetectable — behavioral (timing) analysis still applies.

Background

A C2 profile controls:

A profile with all six defaults is caught by any of six independent detection rules. Each custom value the operator sets removes one detection opportunity — but behavioral detection (beacon timing analysis from Lab 01) survives all profile customization.

Functions to Implement

Profile Dict Schema

{
    "named_pipe": str,          # e.g., r"\\.\pipe\msagent_abc"
    "user_agent": str,          # HTTP User-Agent string
    "uri_paths": list[str],     # list of URI path strings
    "sleep_seconds": int,       # base sleep interval
    "jitter_percent": int,      # jitter percentage (0-100)
    "tls_ja3": str,             # JA3 hash string
    "cert_subject": str,        # TLS certificate subject
    "cdn_fronted": bool,        # optional — True if CDN fronting configured
}

Running the Lab

# Install dependencies
pip install pytest

# Run stubs (should fail — NotImplementedError expected)
pytest -q

# Run reference solution (should pass — 13/13 tests)
LAB_MODULE=solution pytest -q

Files

Cedar Lattice Connection

The output of this lab is the core of the Phase 08 deliverable:

• profile_noise_score → "Profile Noise Assessment" section (score + breakdown)
• redirector_gaps → "Redirector Configuration Findings" section
• detection_opportunities → "Detection Opportunities" section (what the SOC could have detected)
• best_mitigation → "Highest-Impact Recommendation" (single actionable item for operator)

A score of 6 means the engagement was detectable by six independent single-rule detections on day one. A score of 0 means only behavioral analysis (Lab 01) could have detected the traffic — a much more sophisticated detection requirement for Meridian Freight's SOC.

« Phase 08