C2 and Beaconing

How C2 Works and Why Beaconing Is the Signature

• Command and Control (C2) is the communication channel between an attacker’s infrastructure and malware implanted on compromised hosts.
• MITRE ATT&CK maps C2 to T1071 (Application Layer Protocol) with sub-techniques for HTTP/HTTPS, DNS, and other protocols.
• The C2 channel serves three purposes: (1) Beaconing — the implant checks in at regular intervals to signal it is alive and retrieve commands. (2) Tasking — the attacker sends commands (execute, exfiltrate, sleep, upgrade). (3) Exfiltration — stolen data flows back through the same channel.

Beacon Timing Analysis — The Core Detection Method

Beaconing produces a distinctive signal in network telemetry: the implant connects to the C2 server at regular, predictable intervals. The precision of the interval reveals the C2 framework.

How Attackers Time Their Beacons

Detecting Beacons with Network Flow Data

SPL query — jitter analysis using inter-arrival times:

index=netflow sourcetype=netflow
| search dest_port=443 AND bytes<1000
| sort src_ip, _time
| streamstats current=f false window=1 first(_time) as prev_time by src_ip, dest_ip
| eval interval = _time - prev_time
| where interval > 0 AND interval < 300
| stats count, avg(interval) as avg_interval, stdev(interval) as jitter, values(interval) as intervals by src_ip, dest_ip, dest_port
| where count > 10 AND jitter < (avg_interval * 0.3)
| eval alert = "HIGH — C2 beacon pattern: " . src_ip . " → " . dest_ip . " avg interval " . round(avg_interval, 1) . "s, jitter " . round(jitter, 1) . "s"
| table src_ip, dest_ip, avg_interval, jitter, count, alert

This query filters for small outbound packets (likely beaconing, not data exfiltration), groups by source/destination pairs, and calculates the standard deviation of intervals. A low jitter relative to the average interval is the beacon signature.

C2 Protocols and Their Indicators

HTTP/HTTPS C2 — The Most Common

DNS C2 — Hard to Block

Custom Protocol C2

JA3 Fingerprinting for C2 Detection

JA3 creates a hash of the TLS client’s handshake parameters (cipher suites, TLS extensions, elliptic curves). Every TLS stack offers a unique JA3 fingerprint.

Known Malicious JA3 Hashes (C2 Frameworks)

SPL query — detect Cobalt Strike JA3:

index=network sourcetype=ja3
| search ja3_hash="6734f37431670b3ab4292b8f60f29984" OR ja3_hash="deada991e16a304f4bcb617b32c1e8a5"
| stats values(dest_ip) as C2_Ips, values(ja3_hash) as JA3 by src_ip, _time
| eval alert = "CRITICAL — C2 beacon: Cobalt Strike JA3 detected from " . src_ip
| table _time, src_ip, C2_Ips, alert

C2 Detection Workflow

Step 1: Identify the Beacon

Search for the distinctive beacon pattern: small, regular outbound connections from a single host to a single external IP.

Key query — find hosts with regular outbound connections to the same IP:

index=proxy
| search dest_port=443
| stats count, dc(dest_port) as Ports, values(dest_ip) as Destinations by src_ip, user_agent
| where count > 50 AND Ports < 3
| eval alert = "SUSPICIOUS — host " . src_ip . " made " . count . " outbound connections to " . Destinations

Step 2: Correlate with EDR

Once you have a suspected C2 beaconing host:

• Check EDR for anomalous processes — especially PowerShell, wscript, rundll32, regsvr32
• Check for recent file creation — malware dropped on disk
• Check parent-child process relationships — was the malware executed by a document or email client?
• Check scheduled tasks — does the malware have persistence?

Step 3: Analyze the Destination

• Check domain WHOIS — registered recently? Privacy-protected?
• Check the domain reputation — VirusTotal, AlienVault OTX, other intel feeds
• Check the IP reputation — AbuseIPDB, VirusTotal
• Check crt.sh for SSL certificates issued for the domain — recently issued?
• Check if the domain has a favicon, privacy policy, or any content — C2 domains often serve default web server pages

Step 4: Determine Disposition

Preventative Controls

Related

• MITRE ATT&CK for Triage — covers the mitre att&ck for triage concepts
• Cobalt Strike — Detection and Beacon Analysis — detection and response for T1055, T1572, T1071 techniques
• RITA — detection and response for T1071 techniques
• Web Application Attacks — SSRF, CSRF, Command Injection, Path Traversal, IDOR — detection and response for T1190 techniques
• API Attacks — OWASP API Top 10 — detection and response for T1190 techniques

Sources

• MITRE ATT&CK T1071
• RITA
• CISA Alert on C2 Detection
• SANS — Beacon Detection with Zeek
• AbuseIPDB — IP Reputation Check