hunting-for-command-and-control-beaconing

name	hunting-for-command-and-control-beaconing
description	Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","c2","beaconing","network-analysis","proactive-detection"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]
mitre_attack	["T1046","T1057","T1082","T1083","T1071"]

Hunting for Command and Control Beaconing

When to Use

• When proactively hunting for compromised systems in the network
• After threat intel indicates C2 frameworks targeting your industry
• When investigating periodic outbound connections to suspicious domains
• During incident response to identify active C2 channels
• When DNS query logs show unusual patterns to specific domains

Prerequisites

• Network proxy/firewall logs with full URL and timing data
• DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)
• Zeek/Bro network connection logs or NetFlow data
• SIEM with statistical analysis capabilities (Splunk, Elastic)
• Threat intelligence feeds for domain/IP reputation

Workflow

1. Identify Beaconing Characteristics: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).
2. Collect Network Telemetry: Aggregate proxy logs, DNS queries, and connection metadata for analysis.
3. Apply Frequency Analysis: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).
4. Filter Known-Good Traffic: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).
5. Analyze Domain/IP Reputation: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.
6. Investigate Endpoint Context: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.
7. Confirm and Respond: Validate C2 activity, block communication, and initiate incident response.

Key Concepts

Concept	Description
T1071	Application Layer Protocol (HTTP/HTTPS/DNS C2)
T1071.001	Web Protocols (HTTP/S beaconing)
T1071.004	DNS (DNS tunneling C2)
T1573	Encrypted Channel
T1572	Protocol Tunneling
T1568	Dynamic Resolution (DGA, fast-flux)
T1132	Data Encoding in C2
T1095	Non-Application Layer Protocol