SOP-09: C2 Beaconing Detection & Response

·

Command-and-Control beaconing is the communication heartbeat between a malware implant and its operator. Once established, the attacker has persistent remote access — executing commands, staging exfiltration, and moving laterally. Breaking this channel is the analyst's primary containment goal.

C2 frameworks like Cobalt Strike, Sliver, Havoc, and Brute Ratel use traffic blending, jitter, and domain fronting to evade network controls. Detection relies on behavioral patterns — periodic connection regularity, unusual process-to-network mappings, and DNS anomalies — not just static signatures.

◈ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation
01

Background

CONTEXT
B1C2 Framework Signatures
FrameworkMITREKey Network IndicatorProcess Indicator
Cobalt StrikeT1071.001, T1573Default beacon sleep 60s, malleable profile headers, JARM fingerprint 07d14d16d21d21d07c42d43d000000rundll32.exe or injected svchost with unusual outbound HTTPS
SliverT1071.001, T1132mTLS/WireGuard C2, HTTP implants with /fonts/ /stylesheets/ URI patterns, implant JARM differs per buildInjected process; memory-only implant via shellcode
Havoc / BruteRatelT1071, T1573Daemon implant, encrypted HTTP channel, DemonID in headersUnusual child of Office, browser, or LOLBin
Metasploit MeterpreterT1059.001, T1095Reverse TCP/HTTPS; staged payload uses GET to download stage 2rundll32, powershell, wscript running shellcode
DNS C2 (Iodine, dnscat2)T1071.004High-volume TXT/NULL record queries to single domain; encoded data in subdomains; >100 DNS req/min per hostAny process making unusual DNS volume
B2Log Sources & Detection Coverage
Log SourceTable / IndexWhat It Catches
Defender for EndpointDeviceNetworkEvents, DeviceProcessEventsProcess-to-IP mapping; connection regularity; rare domain connections
DNS logs (Defender/Sentinel)DnsEvents, DeviceNetworkEvents (DnsQueryType)High-volume DNS, long subdomain labels, NX domain ratios
Proxy / Firewallindex=proxy or CommonSecurityLogPeriodic connections, abnormal user agents, domain fronting
SysmonEventCode 3 (NetworkConnect), 22 (DNSQuery)Per-process network telemetry, DNS query volume per process
02

Identification

INVESTIGATE
C2 Investigation Workflow
I1Beacon Regularity — Statistical DetectionKQL + SPL
KQL — Defender Advanced Hunting: Beacon interval analysis
// Detect regular beaconing: same process connects to same IP every ~N seconds let device = "DEVICE_NAME"; DeviceNetworkEvents | where Timestamp > ago(6h) | where DeviceName == device | where ActionType == "ConnectionSuccess" | where RemotePort in (80, 443, 8080, 8443) // Exclude known-good CDN ranges — add your own exclusions | where RemoteIPType != "Private" | summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), AvgIntervalSeconds = (max(Timestamp) - min(Timestamp)) / count() by InitiatingProcessFileName, RemoteIP, RemoteUrl | where ConnectionCount >= 5 | where AvgIntervalSeconds between (30sec .. 300sec) // 30s–5min = beacon sweet spot | order by ConnectionCount desc
SPL — Splunk (Sysmon EventCode 3 or proxy)
index=sysmon EventCode=3 DestinationPort IN (80,443,8080,8443) host="DEVICE_NAME" DestinationIsIpv6=false | bucket _time span=5m | stats count by _time, Image, DestinationIp, DestinationPort | eventstats stdev(count) AS stdev, avg(count) AS avg by Image, DestinationIp | where stdev < (avg * 0.3) // low variance = very regular = beacon | where count > 2 | table _time, Image, DestinationIp, DestinationPort, count, avg, stdev | sort avg desc
I2DNS Tunnelling DetectionKQL + SPL
KQL — High-volume or long-label DNS queries
// DNS tunnelling: many queries to same parent domain OR very long subdomain labels DeviceNetworkEvents | where Timestamp > ago(2h) | where ActionType == "DnsQueryResponse" | extend DomainParts = split(RemoteUrl, ".") | extend ParentDomain = strcat(tostring(DomainParts[-2]), ".", tostring(DomainParts[-1])) | extend SubLabel = tostring(DomainParts[0]) | summarize QueryCount = count(), AvgLabelLen = avg(strlen(SubLabel)), MaxLabelLen = max(strlen(SubLabel)) by DeviceName, ParentDomain, InitiatingProcessFileName | where QueryCount > 100 or MaxLabelLen > 40 | order by QueryCount desc
SPL — Sysmon DNS (EventCode 22)
index=sysmon EventCode=22 | eval domain_len=len(QueryName) | eval subdomain=mvindex(split(QueryName,"."),0) | eval sub_len=len(subdomain) | stats count AS query_count, avg(domain_len) AS avg_len, max(sub_len) AS max_sub_len by host, QueryName, Image | where query_count > 50 OR max_sub_len > 40 | sort -query_count

DNS tunnelling tools like dnscat2 encode C2 traffic in subdomain labels. A label length over 40 characters is a strong indicator — legitimate domains almost never have labels this long.

I3Process-to-Network Anomaly HuntKQL
KQL — Processes that should NOT be making outbound connections
// Suspicious: Office apps, script engines, and system utilities making HTTPS connections DeviceNetworkEvents | where Timestamp > ago(24h) | where ActionType == "ConnectionSuccess" | where RemoteIPType != "Private" | where RemotePort in (80, 443, 8080, 8443, 4444, 5555) | where InitiatingProcessFileName in~ ( "winword.exe", "excel.exe", "powerpnt.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "msiexec.exe", "odbcconf.exe", "mavinject.exe" ) | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort | order by Timestamp desc

Cobalt Strike frequently injects into rundll32.exe or svchost.exe. A process that was NOT making outbound connections 24 hours ago but is now regularly beaconing is a high-fidelity signal — compare against baseline with 7d window.

03

Containment

STOP IT
C1Isolate Device & Block C2 InfrastructureImmediate
  • 1
    Isolate the device: Defender XDR → Device page → Isolate device → Full isolation. This cuts all network except Defender telemetry.
  • 2
    Block C2 IPs and domains org-wide: Defender XDR → Settings → Endpoints → Indicators → Add IP and URL/Domain indicators with action = Block. This propagates to all enrolled devices.
  • 3
    Block at firewall/proxy: Notify network team to null-route the C2 IPs and add domain to DNS RPZ (Response Policy Zone) for additional coverage.
  • 4
    Do NOT kill the beacon process immediately until the investigation package is collected — the process memory may hold decrypted C2 config (IP, encryption keys, staging paths).

Killing the beacon before collecting a process memory dump destroys evidence. Isolation cuts the network channel while keeping the process alive for forensics — do isolation first, collection second, process kill third.

C2Collect Forensic Evidence
  • 1
    Live Response → collect investigation package — captures running processes, network connections, scheduled tasks, registry run keys, and event logs.
  • 2
    Note the beacon process PID, parent PID, command line, and file path. If the process is fileless (injected), note the host process.
  • 3
    Export C2 IP/domain list for org-wide threat hunting (I3 KQL across all devices).
04

Eradication

CLEAN UP
E1Remove Implant & Persistence
  • 1
    Kill the beacon process via Live Response: run taskkill /F /PID [pid]. If injected, kill the host process.
  • 2
    Remove implant file on disk. If fileless, remove the loader (scheduled task, registry run key, WMI subscription) that staged it.
  • 3
    Run Defender full scan on isolated device: run MpCmdRun.exe -Scan -ScanType 2 in Live Response.
  • 4
    Verify no remaining outbound connections to C2 infrastructure after implant removal — re-run I1 KQL on a 1h post-cleanup window.
  • 5
    If a kernel rootkit or bootkit is suspected — do not attempt in-situ cleanup. Reimage from known-good baseline.
Eradication Complete When
  • Zero beacon connections to C2 infrastructure in last 1h
  • Implant file and all persistence mechanisms removed
  • Defender full scan returns clean on isolated device
  • No additional hosts identified beaconing to same C2
05

Escalation

TIERS
ESC1Escalation Tiers
TierTriggerAction
L1 → L2TP confirmed, single host, no lateral movement, C2 blockedHand off with: C2 IPs/domains, implant path/hash, beacon interval, persistence mechanism
L2 → IR TeamMultiple hosts beaconing, credential dump or lateral movement detected, data staging observedIR takes lead. Scope full compromise. Cross-reference SOP-07 (Exfiltration), SOP-06 (Lateral Movement)
IR → CISONation-state TTPs, APT attribution indicators, data confirmed exfiltrated, critical infrastructure targetedCISO + Legal notified, external IR retainer engaged if needed

Authorized security research & penetration testing only. Unauthorized use is illegal. Authored by Rudra Verma | Senior Security Architect | CyberHawk Consultancy.

◈ Stay Connected

Follow CyberHawk Threat Intel for SOC SOPs, threat intelligence, and hands-on analyst tooling.

Website YouTube Twitter / X TikTok Telegram
SOPs Blog Courses

"They can't exploit you if you are the Exploit."