https://nonamecon.org/hunting-for-apt-in-network-logs-workshop/
Hunting for APT in network logs (Workshop)