Summary
In this chapter, we went through the process of proving or disproving the hypothesis There are malicious actors (trying) to beacon out to external IPs/domains. We saw how by combining data, tools, techniques, and activities, we managed to not only prove our hypothesis but also found compromised systems in our environment. This chapter was the first of three hypotheses that, combined, form an effective strategy to clean up of verify the environment of a new or long-neglected part of the industrial network.
In the next chapter, we are going to perform threat hunting activities around the second hypothesis, There is malware installed on our systems.
