Network Detection: C2 Beaconing & DNS Exfiltration in SIEM

Prerequisites

• COA-K001: SOC Architecture & Alert Lifecycle
• FND-K005: DNS Internals & Anomaly Detection (recommended)

Why This Lesson Matters

After initial access and execution, malware needs to phone home — to receive commands and exfiltrate data. C2 (Command & Control) communication and DNS exfiltration are the two most common covert channels. Detecting them in SIEM network logs is a core COA skill that separates L1 analysts who only handle rule-triggered alerts from L1 analysts who can proactively spot anomalies.

1. C2 Communication Fundamentals

A C2 agent establishes communication with an operator-controlled server. The agent checks in periodically (beacons) and receives instructions.

1.1 Why Beaconing is Detectable

Every beacon has a period — the interval between check-ins. Even when jitter (randomness) is added, the inter-arrival time distribution clusters around the base period.

Pure beacon (period=60s):    0s, 60s, 120s, 180s, 240s → peak at 60s
Jittered beacon (±20%):      0s, 53s, 128s, 174s, 248s → peak still visible at ~60s

The statistical signal survives moderate jitter. Analysts at SOC platforms use histogram analysis of inter-arrival times grouped by (src_ip, dst_ip) pair.

1.2 C2 Protocol Variants and Their Signatures

1.3 Beaconing Detection in SIEM: Netflow Approach

# Python concept: inter-arrival time histogram for a (src,dst) pair
import pandas as pd, matplotlib.pyplot as plt

df = pd.read_csv("netflow.csv", parse_dates=["timestamp"])
pair = df[(df.src_ip=="10.0.0.42") & (df.dst_ip=="185.220.101.5")].sort_values("timestamp")
pair["delta_s"] = pair["timestamp"].diff().dt.total_seconds()

# Plot histogram — a beacon will show a sharp peak
pair["delta_s"].hist(bins=60, range=(0,600))
plt.title("Inter-arrival times: 10.0.0.42 → 185.220.101.5")
plt.xlabel("Seconds between connections"); plt.show()

# Summary stats
print(pair["delta_s"].describe())
# A beacon: mean ≈ std ≈ base_period, low variance relative to mean

SIEM query concept (KQL / Splunk-like):

index=network src_ip=* dst_ip=*
| stats count, min(timestamp), max(timestamp) by src_ip, dst_ip
| eval duration_hrs = (max-min)/3600
| eval rate_per_hr = count/duration_hrs
| where count > 20 AND rate_per_hr > 4 AND rate_per_hr < 60
| sort - count

Connections that occur 4–60 times per hour over multiple hours are candidates for beaconing. Exclude known CDNs, cloud providers, update servers.

2. HTTP-Based C2 Signatures

Cobalt Strike, Metasploit Meterpreter, and similar frameworks use HTTP(S) for C2. They leave characteristic signatures:

2.1 Suspicious HTTP C2 Patterns

# tshark: find periodic small GETs from same host
tshark -r capture.pcap -Y "http.request.method == GET" 
  -T fields -e frame.time -e ip.src -e http.host -e http.request.uri 
  -e http.content_length 
  | awk -F' ' '$5 < 500 || $5 == ""' 
  | sort

2.2 JA3 Fingerprinting for TLS C2

JA3 is a fingerprint of the TLS ClientHello handshake. Malware C2 clients produce distinctive JA3 hashes because they use custom TLS stacks.

# Extract JA3 hashes from a PCAP (requires ja3 tool)
ja3 -a capture.pcap | sort | uniq -c | sort -rn | head

# Known malicious JA3 hashes (Cobalt Strike default)
# 72a589da586844d7f0818ce684948eea  ← Cobalt Strike default
# Cross-reference against known-bad lists: https://ja3er.com

3. DNS Exfiltration in SIEM

3.1 Detection Signals (SIEM Perspective)

When you have DNS query logs in your SIEM, apply these detection queries:

3.2 Reconstructing a DNS-Exfiltrated Payload

When you identify the exfiltration domain, reconstruct the payload in chronological query order:

# Step 1: Extract queries to the exfil domain, sorted by time
tshark -r capture.pcap 
  -Y "dns.qry.name contains ".exfil.evil.com" and dns.flags.response==0" 
  -T fields -e frame.time_epoch -e dns.qry.name 
  | sort -n 
  | awk '{print $2}' 
  | sed 's/.exfil.evil.com//'

# Step 2: Concatenate and decode
# (base32 example)
... | tr -d '
' | base32 -d 2>/dev/null

# (base64 example — replace - with + and _ with / for base64url)
... | tr '_-' '/+' | tr -d '
' | base64 -d 2>/dev/null

4. Threat Enrichment: IOC Lookups

When you extract an IP, domain, or hash from a SIEM alert, enrichment tells you whether it is known malicious before you spend time investigating.

4.1 Key Enrichment Sources

4.2 Enrichment Workflow

Alert: outbound connection from 10.0.0.42 → 185.220.101.5:443

Step 1: VirusTotal IP lookup → 185.220.101.5
  → 37/90 engines flag as malicious
  → Tagged: Cobalt Strike C2, Tor exit node
  → First seen: 2026-05-01 (recent — suspicious)

Step 2: Shodan lookup → 185.220.101.5
  → Open ports: 80, 443, 8080
  → Banner: Nginx/1.18 (default)
  → ASN: AS20473 (Choopa/Vultr) — common malware hosting

Step 3: Passive DNS → 185.220.101.5
  → Resolves to: updates-cdn.net, windowsupdate-cdn.com
  → Domain registered: 2026-05-02 (2 days after IP first seen)

Step 4: AbuseIPDB → 185.220.101.5
  → 47 abuse reports in last 30 days
  → Category: C2 server

Conclusion: Confirmed malicious. Escalate to P1. Block IP at firewall.

5. Common Mistakes

Mistake 1: Not sorting DNS queries by timestamp before reconstructing. DNS packets may arrive out of order or be logged out of order. Sort by frame.time_epoch (not human-readable timestamp which has variable width) before concatenating.

Mistake 2: Blocking a C2 IP without checking for other infected hosts. One infected host communicating with a C2 IP should trigger a hunt: check all other hosts for connections to the same IP or the same JA3 fingerprint.

Mistake 3: Treating VirusTotal 0/90 as "definitely clean." Newly registered domains and IPs used for the first time may have zero detections. Check registration date, hosting provider, and certificate information — a 2-day-old domain hosting an Nginx default page on a VPS is suspicious regardless of VT score.

6. Practice Exercises

1. You have netflow data showing host 10.0.0.50 makes connections to 185.220.101.7 at approximately: 14:00, 14:01:03, 14:02:01, 14:03:05, 14:04:02. Calculate the mean and standard deviation of inter-arrival times. Is this likely beaconing? What is the approximate beacon period?

2. A SIEM alert shows 847 DNS queries from host 10.0.0.33 to subdomains of updates-svc.net in one hour. The subdomain labels are 35–45 characters of mixed uppercase and digits. What detection signals are present? What action do you take?

3. Enrich this IP using the enrichment workflow: 45.33.32.156. (Note: this is Scanme.nmap.org, a public test host. What does Shodan show for it? Is it malicious?)

7. Lab

Assessment mode: flag

challenge_spec_id: 369 — C2 beaconing detection

You are given a netflow CSV file. A host on the network has an active C2 implant beaconing to an external IP.

Task: 1. Identify the (src_ip, dst_ip) pair with beaconing behaviour using inter-arrival time analysis 2. Confirm the beacon period (within ±5 seconds) 3. The flag is formatted as PREFIX{src_ip:dst_ip:beacon_period_seconds}

8. Framework Alignment

9. Further Reading

• Cobalt Strike Threat Intelligence — https://blog.cobaltstrike.com — Understanding what you are defending against
• JA3 / JA3S fingerprinting — https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967
• VirusTotal API documentation — For automating IOC enrichment in SOAR playbooks
• RITA (Real Intelligence Threat Analytics) — https://github.com/activecm/rita — Open-source beaconing detection tool

["Calculate inter-arrival time statistics for a set of netflow connection records and determine whether they are consistent with C2 beaconing", "Identify three HTTP-based C2 signatures in a PCAP or access log (User-Agent anomaly, fixed URI pattern, response-size mismatch)", "Apply a four-step IOC enrichment workflow to a suspected C2 IP address and produce an enrichment summary that supports an escalation decision"]

Prerequisites → Why this matters → C2 fundamentals (beacon period, jitter, protocol variants and signatures) → Beaconing detection via inter-arrival time histogram → HTTP C2 signatures → JA3 TLS fingerprinting → DNS exfiltration in SIEM (detection signals, payload reconstruction) → IOC enrichment workflow (sources + worked example) → Common mistakes → Practice exercises → Lab (flag, spec 369) → Framework alignment → Further reading