SOP-09: C2 Beaconing Detection & Response

SOC analyst SOP for detecting and disrupting C2 beaconing — beacon interval analysis, DNS tunnelling, HTTPS C2, Cobalt Strike/Sliver/Havoc signatures, KQL for Defender/Sentinel, SPL for Splunk, containment and eradication steps.