detecting-beaconing-patterns-with-zeek

What problem does it solve?

Zeek logs often contain scattered connection events; this skill analyzes inter-arrival times to reveal beaconing behavior and suspicious periodicity, enabling faster detection of C2 activity.

Core Features & Use Cases

• Statistical analysis of Zeek conn.log connection intervals to flag low-variance beacon patterns.
• Supports grouping by source/destination and port to identify beaconing between hosts.
• Provides a ready-to-run Python agent for automated beaconing detection and reporting.

Quick Start

Run the agent against Zeek conn.log (and dns.log if available) to produce a beaconing report.