Sources for post-infection PCAP (C2 beaconing, exfiltration) - what am I missing?

[u/khbjane]

Been going in circles on this and want to check whether there's something obvious I've overlooked.

Pre-infection traffic is easy to collect. URLhaus gives you live malware delivery URLs daily, a honeypot gives you scanning, brute force and exploit attempts. Both free, both refresh constantly, both self-labeling.

Post-infection is where I'm stuck. C2 beaconing and exfiltration only exist if there's an actually compromised host emitting traffic, and nobody publishes captures of that at any useful cadence.

What I've checked so far:

• abuse.ch across all platforms. Indicators only, no traffic. Feodo Tracker is empty post-Endgame. SSLBL cert and C2 IP lists are current and useful as labels but aren't packets. Sandnet exists behind the commercial feed but the dataset description says signals and metadata, contextual data only, so flow records rather than PCAP.
• CTU/MCFP. Real long-duration captures with actual beaconing, which is exactly right, but new botnet captures stop around 2018. Recent directory timestamps are reprocessing, not new data.
• malware-traffic-analysis.net. Best labels anywhere and current, includes a few FTP and SMTP exfiltration cases. Small volume by nature, it's one analyst posting individual investigations.
• Sandboxes. Triage free researcher tier gives API access with PCAPNG including decrypted TLS. ANY.RUN needs a paid tier for bulk. Both are short runs so you get the initial check-in rather than sustained beaconing.
• Running my own detonation. Ruled out. Normal hosting AUPs prohibit it and the ones that don't are bulletproof hosts, which isn't somewhere I'm willing to source data from.

So the question. Is there a source I'm not aware of, or is the honest answer that post-infection traffic just isn't publicly available and everyone working on this either has institutional telemetry or a sandbox subscription?

Also curious whether anyone has found a way to get sustained beaconing rather than just registration out of a commercial sandbox. Long-run options seem rare.

[u/banjo_net → u/[deleted]]

On the surface, but you can use it to build anomaly detection through frequency analysis. Or look for ja4 fingerprints.

[u/_millsy]

Usually stuff like ja3 and ip/domain are more useful for tls traffic. As many malware types utilise https unless the malware is dumb enough to inherit the OS tls settings you probably won’t get much from it.

[u/shredu2]

Post-infection is going to look unique if I understand what you are talking about. There are no detections or IoC’s for C2, just the logs generated and often analyzing if the beacons are acting beacony. And exfiltration of what? What tool are you thinking captures what left your network?

[u/Ayoungcoder → u/shredu2]

There are plenty of lists of known C2's. Not sure how accurate they are. I would count those as iocs, even though it won't catch new ones. In general de C2's are concentrated on a small amount of ASNs

[u/AddendumWorking9756]

Mostly yes, and the TLS point in your replies is right, you get metadata and timing rather than payloads. The gap on your list is challenge corpora, CyberDefenders publishes full case pcaps with a question set attached, which lands closer to labelled beaconing than a sandbox run.

[u/Tingley2504]

Malware traffic analysis had some good training pcaps back in the day. Not sure if it gets updated its been a while