SGSPECTER.GHOSTCOMMUNITY EDITION
← RANGE INDEX
// LAB 03 · Network

Phantom Packet

A lab subnet shows periodic traffic to a service nobody remembers deploying.

Medium300 PTSTCP/IP · PCAP · DNS
// BRIEFING

MISSION

A lab subnet shows periodic traffic to a service nobody remembers deploying.

OBJECTIVE

Correlate the simulated network evidence and identify the beacon marker.

BOUNDARY

This challenge uses SPECTER.GHOST training material only. Do not target the public portal or systems outside assets explicitly supplied by the lab.

// EVIDENCE PACKET

ARTIFACTS

10:14:00 10.13.7.22 -> resolver.lab DNS A updates.lab
10:14:03 10.13.7.22 -> 10.13.7.9 TCP 443 ACK
10:15:00 10.13.7.22 -> resolver.lab DNS TXT _status.lab
10:15:00 resolver.lab -> 10.13.7.22 TXT "follow_the_beacon"
10:16:00 10.13.7.22 -> resolver.lab DNS TXT _status.lab
HINT 01

The repeated timing matters, but the useful payload is not in the TCP flow.

← Broken TrustMemory Echo →