Lesson 03: Blending with Traffic

Blue teams don’t need to see everything—they look for what doesn’t fit. Your goal is not invisibility but indistinguishability: make your flows look like everyone else’s.

How Detection Works (Practically)

• Protocol rarity: ICMP tunnels, raw TCP, or custom C2 frames on odd ports.
• Timing regularity: beacons at perfectly even intervals (e.g., exactly every 60s).
• Volume anomalies: exfil spikes outside business hours or mismatched to user behavior.
• Rare destinations: traffic to unstable, low-reputation IPs or brand-new domains.
• Header fingerprints: TLS JA3/HTTP headers that don’t match common clients.

Blending Techniques

• Ports & protocols: prefer 80/443 and standards-compliant HTTP(S)/HTTP2; avoid exotic ports.
• Timing jitter: add randomization windows (±15–45%) and sleep distributions (Poisson/normal).
• Pacing & chunking: throttle exfil; chunk payloads into user-like request sizes.
• Domain strategy: age domains, build benign traffic history; avoid fresh registrations for exfil.
• Header mimicry: copy user-agent strings and header ordering; emulate TLS fingerprints.
• Operational hours: align to local business hours unless baseline shows frequent off-hours usage.

Real-World Context

A well-publicized retail breach detection hinged on scheduled FTP exfil at ~03:00 daily—an obvious deviation from baseline POS traffic. Had actors paced exfil over HTTPS during store hours with realistic headers and jitter, time-to-detect likely increases.

Walkthrough: Build a Mimic Profile

1. Capture 24–48h of baseline (Wireshark/Zeek/NetFlow): top domains, median request size, inter-arrival times.
2. Derive parameters: ports, protocols, UA strings, common TLS ciphers, request cadence distributions.
3. Implement client shim: enforce jitter, header order, size ceilings; rotate benign host paths.
4. Test: diff your flows vs. baseline histograms; iterate until distributions overlap.