How to Detect C2 Beaconing Traffic in Your Network Logs

Every C2 session begins with DNS resolution. Even if the C2 traffic itself is HTTPS, the DNS queries are plaintext and often reveal suspicious patterns.

What to look for in DNS logs:

1. High-frequency queries to the same domain from one host:

// Microsoft Sentinel: detect repetitive DNS to same domain
DnsEvents
| where TimeGenerated > ago(24h)
| where QueryType == "A" or QueryType == "AAAA"
| where Name !endswith ".microsoft.com"
    and Name !endswith ".windows.com"
    and Name !endswith ".googleapis.com"
    and Name !endswith ".akamaiedge.net"
    and Name !endswith ".cloudfront.net"  // Extend exclusions for your env
| summarize
    QueryCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Computer, Name
| where QueryCount > 50  // 50+ queries to same domain in 24h is unusual
| extend Duration = LastSeen - FirstSeen
| where Duration > 1h  // Spread over more than 1 hour (not a one-time burst)
| sort by QueryCount desc

1. DGA (Domain Generation Algorithm) detection: many unique domains: Many C2 frameworks use DGA to generate many seemingly random domain names. The malware and the C2 server both run the same algorithm, so only the "correct" domain resolves:

// Hosts querying many unique high-entropy domains in a time window
DnsEvents
| where TimeGenerated > ago(1h)
| extend DomainLength = strlen(Name)
| extend SLD = tostring(split(Name, ".")[-2])  // Second-level domain
| summarize
    UniqueDomainsQueried = dcount(Name),
    AvgDomainLength = avg(DomainLength)
    by Computer, bin(TimeGenerated, 1h)
| where UniqueDomainsQueried > 100  // Unusually many unique domains in 1 hour
    and AvgDomainLength > 12  // Long random-looking domain names
| sort by UniqueDomainsQueried desc

1. Newly registered domains (NRD): Most C2 infrastructure uses newly registered domains: legitimate services have been registered for months or years. Query domain registration age:

# Bulk domain age check using Zeek + whois
# Or use a threat intel feed that includes domain registration dates:
# ThreatFox, URLhaus, Pulsedive all include NRD indicators

# Cisco Umbrella and Cloudflare Gateway have built-in NRD blocking

Proxy logs (if you have a web proxy) and NetFlow logs reveal the timing regularity that characterizes beaconing.

Splunk SPL: beaconing detection via connection timing:

/* Proxy logs: find hosts with periodic connections to the same destination */
index=proxy
| eval epoch=_time
| stats
    values(epoch) as timestamps
    count as conn_count
    avg(bytes) as avg_bytes
    by src_ip, dest_host
| where conn_count > 10
| eval
    /* Calculate standard deviation of inter-arrival times */
    sorted_ts=mvdedup(timestamps)
    inter_arrival_ms=mvrange(0, mvcount(sorted_ts)-1, 1)
    /* This is simplified: production use should calculate actual std dev */
| where avg_bytes < 10000  /* Small payloads typical of beacons */
| where conn_count > 20
| sort -conn_count
| table src_ip, dest_host, conn_count, avg_bytes

Python-based beaconing detector (run against proxy or flow logs):

import pandas as pd
import numpy as np
from scipy import stats

def detect_beacons(df: pd.DataFrame, 
                   time_col='timestamp', 
                   src_col='src_ip', 
                   dst_col='dst_host',
                   min_connections=10) -> pd.DataFrame:
    """
    Detect beaconing by finding src/dst pairs with low standard deviation
    in inter-connection intervals.
    """
    results = []
    
    for (src, dst), group in df.groupby([src_col, dst_col]):
        if len(group) < min_connections:
            continue
        
        # Sort by time and calculate intervals between connections
        times = sorted(group[time_col].astype(float))
        intervals = np.diff(times)  # seconds between each connection
        
        if len(intervals) < 5:
            continue
        
        mean_interval = np.mean(intervals)
        std_interval = np.std(intervals)
        
        # Low coefficient of variation = high regularity = likely beacon
        cv = std_interval / mean_interval if mean_interval > 0 else float('inf')
        
        results.append({
            'src': src,
            'dst': dst,
            'connection_count': len(group),
            'mean_interval_sec': round(mean_interval),
            'std_interval_sec': round(std_interval),
            'coefficient_of_variation': round(cv, 3),
            'beacon_score': 1 - min(cv, 1)  # Higher = more regular = more suspicious
        })
    
    results_df = pd.DataFrame(results)
    # Filter for suspicious beacons: regular timing, many connections
    suspicious = results_df[
        (results_df['coefficient_of_variation'] < 0.25) &  # < 25% variation
        (results_df['connection_count'] > 20)
    ].sort_values('beacon_score', ascending=False)
    
    return suspicious

# Usage with proxy logs:
df = pd.read_csv('proxy_logs.csv', parse_dates=['timestamp'])
df['timestamp'] = df['timestamp'].astype(int) // 10**9  # Convert to Unix seconds
beacons = detect_beacons(df)
print(beacons.head(20))

NetworkMiner and Zeek for packet-level analysis:

# Zeek: extract connection summary for beaconing analysis
# Zeek's conn.log records all TCP/UDP connections with timing, size, and state
zeek -r capture.pcap /opt/zeek/share/zeek/policy/protocols/conn/known-hosts.zeek

# Analyze conn.log for periodic connections:
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes | \
  awk '{print $2, $3, $4, $1}' | sort | \
  awk 'prev==$1$2$3 {print $3, $4-prevt} {prev=$1$2$3; prevt=$4}' | \
  awk '{sum+=$2; count++; if(count%10==0) print "avg:", sum/count, "sec"}'

The most definitive C2 detection combines network data with EDR data: which process on the endpoint is making the beaconing connections? Legitimate processes have expected network behavior: unusual network connections from unexpected processes are high-confidence indicators.

Sysmon Event ID 3 (network connection): process-to-network mapping:

// Sentinel: find processes making many connections to external IPs
SysmonEvent
| where EventID == 3  // NetworkConnect
| where not(DestinationIp matches regex @"^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.)")  // External IPs
| where DestinationPort == 443 or DestinationPort == 80
// Unusual processes making external HTTPS connections:
| where Image !has_any (
    "\\chrome.exe", "\\firefox.exe", "\\msedge.exe", "\\iexplore.exe",
    "\\outlook.exe", "\\teams.exe", "\\onedrive.exe", "\\msteams.exe",
    "\\curl.exe", "\\wget.exe"  // Legitimate tools
  )
| summarize
    ConnectionCount = count(),
    UniqueDestinations = dcount(DestinationIp),
    DestinationSample = make_set(DestinationIp, 5)
    by Computer, Image, bin(TimeGenerated, 1h)
| where ConnectionCount > 10 and UniqueDestinations < 3  // Many connections to few destinations
| sort by ConnectionCount desc

High-suspicion process/network combinations:

// Processes that should never make internet connections
SysmonEvent
| where EventID == 3
| where not(DestinationIp startswith "10."
    or DestinationIp startswith "192.168."
    or DestinationIp startswith "127."
    or DestinationIp startswith "172.")
| where Image has_any (
    "\\powershell.exe",
    "\\cmd.exe",
    "\\wscript.exe",
    "\\cscript.exe",
    "\\mshta.exe",
    "\\regsvr32.exe",
    "\\rundll32.exe",
    "\\svchost.exe"  // Alert if svchost connects to unexpected external IPs
  )
| project TimeGenerated, Computer, Image, DestinationIp, DestinationPort, DestinationHostname
// These combinations are high-confidence malicious

Cobalt Strike specific IOCs:

# Cobalt Strike malleable C2 profiles often contain characteristic patterns:
# - HTTPS with specific URI patterns (/jquery-3.3.1.slim.min.js, /updates.rss)
# - Specific HTTP headers (X-Forwarded-For: with internal IP)
# - JA3 TLS fingerprint: 72a7c13d19aad26 (Cobalt Strike default)

# JA3 fingerprinting from Zeek:
# ssl.log contains ja3 field: compare against known Cobalt Strike JA3 hashes
grep -f cobalt_strike_ja3_hashes.txt ssl.log | awk '{print $5, $6, $7}'

# Cobalt Strike JARM fingerprint (active fingerprinting of TLS server):
# python3 jarm.py <target-ip> <port>
# Compare against known Cobalt Strike JARM fingerprints

A structured C2 beaconing hunt runs through the three detection layers in sequence, correlating findings across layers for confidence:

Step 1: Identify candidates from DNS/proxy (low specificity, many results)

• Hosts querying the same external domain >50 times per day
• Hosts with connections to destinations with low Alexa/Majestic rank (newly registered or obscure)
• Hosts showing statistical regularity in connection timing

Step 2: Correlate with process data (raises confidence significantly)

• For each suspicious host/destination pair, check which process is making the connections
• Is it a browser? (likely benign): Is it an Office application? (suspicious): Is it cmd.exe or PowerShell? (high confidence malicious)

Step 3: Enrich the destination with threat intel

# Check each suspicious destination against multiple intel feeds
curl -s https://pulsedive.com/api/?indicator=suspicious-domain.com

# VirusTotal API
curl -H 'x-apikey: YOUR_KEY' https://www.virustotal.com/api/v3/domains/suspicious-domain.com

# Shodan: what is hosted on this IP?
curl -s https://api.shodan.io/shodan/host/1.2.3.4?key=YOUR_KEY

# Domain age check
whois suspicious-domain.com | grep 'Creation Date'

Step 4: Triage and escalate

• High confidence (suspicious process + regular timing + low-rep destination + fresh domain) → P1 incident
• Medium confidence (regular timing + low-rep domain, but browser process) → add to watchlist, continue hunting
• Low confidence (single signal) → tune detection or add to watchlist

RITA (Real Intelligence Threat Analytics): automated beaconing detection:

# RITA is an open-source tool that analyzes Zeek logs for beaconing, DNS anomalies, and data exfiltration
git clone https://github.com/activecm/rita
# Import Zeek logs:
rita import /path/to/zeek/logs /dataset/name
# Analyze for beacons:
rita show-beacons /dataset/name | head -20
# Output: score, src, dst, connection_count, avg_interval_sec