Hunting for C2 Beaconing
FreeProactively detect command and control beaconing in networks.
Free · Opens the source repo
What Hunting for C2 Beaconing does
The Hunting for Command and Control Beaconing skill is designed for cybersecurity professionals who need to identify and mitigate command and control (C2) communication within their networks. By employing techniques such as frequency analysis, jitter detection, and domain reputation assessment, this skill enables users to detect compromised endpoints that are communicating with adversary infrastructure. This proactive approach is essential for maintaining network integrity and responding to emerging threats.
To effectively use this skill, users must have access to comprehensive network telemetry, including proxy logs, DNS query logs, and connection metadata. The skill guides users through a structured workflow that begins with defining the characteristics of beaconing, such as regular intervals and small payload sizes. It then facilitates the collection of relevant network data, followed by statistical analysis to identify potential beaconing patterns. The skill also emphasizes the importance of filtering out legitimate traffic to ensure accurate detection.
Once potential C2 activity is identified, users are prompted to analyze the reputation of the domains or IPs involved, leveraging threat intelligence feeds and other resources. The skill culminates in a validation step where users can confirm C2 activity and initiate appropriate incident response measures. This comprehensive approach makes the skill suitable for incident responders, threat hunters, and network security analysts looking to enhance their capabilities in detecting and responding to C2 threats.
When to use it
Use this skill when investigating suspicious outbound connections or during proactive threat hunting within your network.
When not to use it
This skill may not be suitable for environments lacking sufficient network telemetry or for users unfamiliar with statistical analysis methods.
What you can build with it
Investigating Suspicious DNS Queries
Use this skill to analyze unusual patterns in DNS queries that may indicate C2 activity, allowing for timely intervention.
Responding to Threat Intelligence Alerts
When threat intel indicates potential C2 frameworks targeting your organization, this skill aids in identifying affected systems.
Proactive Threat Hunting
Incorporate this skill into your threat hunting efforts to uncover hidden compromised endpoints before they can cause damage.
How to install Hunting for C2 Beaconing
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-command-and-control-beaconing --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for Command and Control Beaconing
When to Use
- When proactively hunting for compromised systems in the network
- After threat intel indicates C2 frameworks targeting your industry
- When investigating periodic outbound connections to suspicious domains
- During incident response to identify active C2 channels
- When DNS query logs show unusual patterns to specific domains
Prerequisites
- Network proxy/firewall logs with full URL and timing data
- DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)
- Zeek/Bro network connection logs or NetFlow data
- SIEM with statistical analysis capabilities (Splunk, Elastic)
- Threat intelligence feeds for domain/IP reputation
Workflow
- Identify Beaconing Characteristics: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).
- Collect Network Telemetry: Aggregate proxy logs, DNS queries, and connection metadata for analysis.
- Apply Frequency Analysis: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).
- Filter Known-Good Traffic: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).
- Analyze Domain/IP Reputation: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.
- Investigate Endpoint Context: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.
- Confirm and Respond: Validate C2 activity, block communication, and initiate incident response.
Key Concepts
| Concept | Description |
|---|---|
| T1071 | Application Layer Protocol (HTTP/HTTPS/DNS C2) |
| T1071.001 | Web Protocols (HTTP/S beaconing) |
| T1071.004 | DNS (DNS tunneling C2) |
| T1573 | Encrypted Channel |
| T1572 | Protocol Tunneling |
| T1568 | Dynamic Resolution (DGA, fast-flux) |
| T1132 | Data Encoding in C2 |
| T1095 | Non-Application Layer Protocol |
| Beacon Interval | Time between C2 check-ins |
| Jitter | Random variation in beacon interval |
| DGA | Domain Generation Algorithm |
| Fast-Flux | Rapidly changing DNS resolution |
Tools & Systems
| Tool | Purpose |
|---|---|
| RITA (Real Intelligence Threat Analytics) | Automated beacon detection in Zeek logs |
| Splunk | Statistical beacon analysis with SPL |
| Elastic Security | ML-based anomaly detection for beaconing |
| Zeek/Bro | Network connection metadata collection |
| Suricata | Network IDS with JA3/JA4 fingerprinting |
| VirusTotal | Domain and IP reputation checking |
| PassiveDNS | Historical DNS resolution data |
| Flare | C2 profile detection |
Common Scenarios
- Cobalt Strike Beacon: HTTP/HTTPS beaconing with configurable sleep time and jitter to malleable C2 profiles.
- DNS Tunneling C2: Data exfiltration and command receipt via encoded DNS TXT/CNAME queries to attacker-controlled domains.
- Sliver C2 over HTTPS: Modern C2 framework using HTTPS with configurable beacon intervals and domain fronting.
- DGA-based C2: Malware generating random domains daily, with adversary registering upcoming domains for C2.
- Legitimate Service Abuse: C2 over legitimate cloud services (Azure, AWS, Slack, Discord, Telegram).
Output Format
Hunt ID: TH-C2-[DATE]-[SEQ]
Source IP: [Internal IP]
Source Host: [Hostname]
Destination: [Domain/IP]
Protocol: [HTTP/HTTPS/DNS/Custom]
Beacon Interval: [Average seconds]
Jitter: [Percentage]
Connection Count: [Total connections]
Data Volume: [Bytes sent/received]
First Seen: [Timestamp]
Last Seen: [Timestamp]
Domain Age: [Days]
TI Match: [Yes/No - source]
Risk Level: [Critical/High/Medium/Low]
Frequently asked questions about Hunting for C2 Beaconing
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.