A cipher suite is a defined combination of cryptographic algorithms and parameters selected during a secure communication session. During TLS setup, the client and server negotiate supported suites, while telemetry can record both the client proposal and the selected suite. section 7.1.7
For network hunting, a client-proposed cipher-suite list can act as a repeatable connection indicator because clients often hardcode the suites they support and propose. section 7.1.6
Use cipher-suite telemetry to investigate repeated or suspicious connections:
- Inspect sample events and identify ssl_client_cipher_list or ssl_client_cipher_names alongside bytes and application fields. section 7.1.6
- Group connections by cipher-suite list and total bytes, then compare hosts or destination ranges. section 7.1.7
- Treat a repeated list as an indicator rather than proof, and corroborate it with traffic volume, endpoint context, and application identity. section 7.1.6 section 7.1.7
Recognizing a repeated beacon pattern
Connections from 10.0.0.4 to 162.125.* repeatedly proposed the same 21-value cipher-suite list and commonly transferred 845 bytes. Comparing those results with 10.0.0.18 showed that the same 845-byte pattern occurred alongside legitimate Dropbox activity, while other byte counts used a shorter list. section 7.1.7
