hunting-for-command-and-control-beaconing

Detect C2 beaconing in Zeek logs by analyzing connection timings, jitter, and domain entropy across dns.log, http.log, and conn.log. This Skill applies heuristic thresholds to interval variance and payload consistency to surface periodic, data-exfiltration-like beacons from compromised endpoints.

Command-and-control beaconing is periodic, anomaly-based network communication where compromised endpoints regularly contact a C2 server. This Skill identifies these patterns by analyzing frequency, jitter, and domain reputation in HTTP, DNS, and long-duration connections to reveal infected devices.

Yes, the workflow supports standalone HTTP and DNS beacon detection. While it analyzes long-duration connections from conn.log, it independently applies payload consistency and domain entropy heuristics to HTTP and DNS telemetry to identify C2 activity.

Differentiate legitimate traffic from C2 beaconing by analyzing interval variance, jitter, and domain reputation. This Skill applies heuristic thresholds to connection frequencies and payload consistency in network telemetry to isolate anomalous, periodic communication patterns.

Hunting for C2 beacons exports findings in machine-readable JSON and human-readable Markdown formats. These outputs provide structured indicators and narrative reports to support incident response and compromised endpoint remediation.