Operationalizing External Attack Surface Signals for Early Threat Actor Infrastructure Tracking

Introduction

Adversaries do not deploy their command-and-control (C2) servers or credential-harvesting portals in a vacuum. Days or weeks before a spearphishing email is delivered or an exploit payload is fired, operators must purchase domains, provision TLS certificates, configure DNS records, and stage web services.

In our threat intelligence research, we focus on identifying these weak reconnaissance signals to uncover adversary infrastructure before it is actively weaponized against defenders.

textCopy
[Adversary Steps]                 [Defender Observation Points]
1. Registers lookalike domain ───> Certificate Transparency (CT) Stream Monitoring
2. Sets DNS A record          ───> Passive DNS (pDNS) Churn Analysis
3. Deploys C2 Framework       ───> Active TLS Fingerprinting (JARM)
4. Configures default headers ───> HTTP Response Signature Clustering

1. Certificate Transparency (CT) Stream Ingestion

Under RFC 6962, all publicly trusted TLS certificate authorities must log newly issued certificates to public append-only logs. This creates an invaluable telemetry stream for threat intelligence:

• By subscribing to CT log tails (e.g., Certstream), analysts can run real-time regex matchers against corporate domains, executive names, or conference acronyms.
• When an adversary provisions a Let's Encrypt or ZeroSSL certificate for company-login-verify[.]com, defenders can flag the registration minutes after issuance.

2. Active TLS Fingerprinting with JARM

JARM is an active TLS server fingerprinting tool. By sending 10 carefully crafted TLS Client Hello packets to a target IP and analyzing the specific cipher suites, extensions, and protocol versions negotiated in the Server Hello responses, JARM produces a unique 62-character hash.

textCopy
Adversary Stages Mythic C2 or Cobalt Strike on a VPS
                    │
                    ▼
Defender Scans with JARM (10 Client Hello Probes)
                    │
                    ▼
Yields Signature: 29d29d15d29d29d00042d42d0000000d087b22a074092b77a06c8b...
                    │
                    ▼
Matches Known Default Profile for C2 Framework

Because adversaries often fail to customize default TLS stack settings in their C2 listener configurations, JARM clustering rapidly links disparate IP addresses to the same threat group.

Conclusion

Modern threat intelligence must move beyond static reactive blocking of already-weaponized hashes. By operationalizing external attack surface signals—CT logs, passive DNS, and TLS heuristics—defenders can illuminate adversary infrastructure while it is still in the staging phase.