Individual skill
hunting-for-command-and-control-beaconing
Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
internal/tools/skills/data/threat-hunting/hunting-for-command-and-control-beaconing/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,325
- Repository last updated
- Nov 9, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- threat-hunting Declared skill tag
- mitre-attack Declared skill tag
- c2 Declared skill tag
- beaconing Declared skill tag
- network-analysis Declared skill tag
- proactive-detection Declared skill tag
- devops Derived category
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Hunting for Command and Control Beaconing
## When to Use
- When proactively hunting for compromised systems in the network
- After threat intel indicates C2 frameworks targeting your industry
- When investigating periodic outbound connections to suspicious domains
- During incident response to identify active C2 channels
- When DNS query logs show unusual patterns to specific domains
## Detection Gaps & Validation
- **Jitter and long sleep break naive frequency rules:** interval + 0–50% jitter (Cobalt Strike) and multi-hour sleeps drop the connection count and inflate CV — score on bytes-out consistency and use autocorrelation over a 7–14 day window, not a single-day `CV < 0.2`.
- **Encrypted/allowlisted channels:** TLS (T1573), domain fronting, and C2 over Slack/Discord/Telegram/Graph API ride trusted FQDNs — destination reputation alone misses them; pivot to JA3/JA4 (use Zeek `ssl.log`/Suricata, since Sysmon EID 3 lacks it) and timing.