detecting-beaconing-patterns-with-zeek

Name: detecting-beaconing-patterns-with-zeek
Availability: InStock
Author: YukiIto1999

Analyze Zeek conn.log data to detect C2 beaconing patterns.

Updated Apr 23, 2026

Search Tags:#logs #beaconing #forensics #threat-detection #network-security #zeek #conn.log

Ready to run

npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill detecting-beaconing-patterns-with-zeek

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: detecting-beaconing-patterns-with-zeek
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/detecting-beaconing-patterns-with-zeek
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill detecting-beaconing-patterns-with-zeek

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires numpy, pandas, zat, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Zeek logs often contain scattered connection events; this skill analyzes inter-arrival times to reveal beaconing behavior and suspicious periodicity, enabling faster detection of C2 activity.

Core Features & Use Cases

Statistical analysis of Zeek conn.log connection intervals to flag low-variance beacon patterns.
Supports grouping by source/destination and port to identify beaconing between hosts.
Provides a ready-to-run Python agent for automated beaconing detection and reporting.

Quick Start

Run the agent against Zeek conn.log (and dns.log if available) to produce a beaconing report.

Frequently Asked Questions about detecting-beaconing-patterns-with-zeek

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect C2 beaconing patterns in Zeek conn.log files?▼

Beaconing detection involves analyzing Zeek conn.log inter-arrival times to identify suspicious periodicity and low-variance patterns indicative of C2 activity. This statistical approach flags regular communication intervals between compromised hosts and command and control servers.

How do I analyze Zeek logs for beaconing using Python and pandas?▼

You can analyze Zeek logs for beaconing by loading conn.log data with the ZAT library and using pandas to compute interval statistics. This process groups connections by source, destination, and port to identify low-variance inter-arrival times characteristic of beaconing behavior.

Do I need the ZAT library to compute beaconing metrics from Zeek logs?▼

Yes, you need the ZAT library along with Python 3.8+, numpy, and pandas to load Zeek logs and compute beaconing metrics. These dependencies are required to parse conn.log files and perform the statistical analysis needed for beaconing detection.

Can I use this beaconing analysis for incident response and network forensics?▼

Yes, you can use this beaconing analysis for incident response, threat hunting, and network forensics. By applying statistical analysis to Zeek conn.log and dns.log data, it reveals C2 beaconing behavior and suspicious periodicity for faster detection during investigations.

What is the best way to identify low-variance beacon patterns in network traffic?▼

The best way to identify low-variance beacon patterns is to statistically analyze inter-arrival times of network connections. By computing interval statistics on Zeek conn.log data grouped by source, destination, and port, you can reveal regular periodicity indicative of C2 beaconing.

Does this beaconing detection approach support grouping by destination and port?▼

Yes, this beaconing detection approach supports grouping by source, destination, and port to identify beaconing between hosts. This grouping allows the statistical analysis to isolate specific communication flows in Zeek conn.log data and accurately flag suspicious periodic connections.