sica-fondt/knowledge/cyber-skills/skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md

API Reference: Beaconing Detection via Frequency Analysis

Beaconing Characteristics

Characteristic	Description
Regular intervals	Connections at fixed time periods
Low jitter	Small variance in intervals
Persistent	Continues over hours/days
Consistent size	Similar packet sizes

Jitter Calculation

Standard Deviation of Intervals

import math
intervals = [t[i+1] - t[i] for i in range(len(t)-1)]
mean = sum(intervals) / len(intervals)
variance = sum((x - mean)**2 for x in intervals) / len(intervals)
jitter = math.sqrt(variance)
jitter_percent = (jitter / mean) * 100

Jitter Thresholds

Jitter %	Confidence	Likely Cause
< 5%	HIGH	Automated C2 beacon
5-15%	MEDIUM	Possible C2 with sleep jitter
15-30%	LOW	May be legitimate polling
> 30%	NONE	Likely human/random

Zeek conn.log Format

Fields

Index	Name	Description
0	ts	Unix timestamp
2	id.orig_h	Source IP
3	id.orig_p	Source port
4	id.resp_h	Destination IP
5	id.resp_p	Destination port
6	proto	Protocol
9	orig_bytes	Sent bytes
10	resp_bytes	Received bytes

RITA (Real Intelligence Threat Analytics)

Analyze Zeek Logs

rita import /path/to/zeek/logs dataset_name
rita show-beacons dataset_name

Output Columns

Column	Description
Score	Beacon probability (0-1)
Source	Source IP
Destination	Destination IP
Connections	Total connections
Avg Bytes	Average data transfer

Splunk SPL — Beacon Detection

index=network sourcetype=zeek:conn
| bin _time span=60s
| stats count by src_ip, dest_ip, dest_port, _time
| streamstats window=100 stdev(count) as jitter avg(count) as avg_count by src_ip, dest_ip
| where jitter/avg_count < 0.15
| stats count as beacon_count by src_ip, dest_ip, dest_port
| where beacon_count > 100

Elastic SIEM — Beacon Detection

{
  "query": {
    "bool": {
      "must": [
        {"range": {"@timestamp": {"gte": "now-24h"}}},
        {"exists": {"field": "destination.ip"}}
      ]
    }
  },
  "aggs": {
    "by_flow": {
      "composite": {
        "sources": [
          {"src": {"terms": {"field": "source.ip"}}},
          {"dst": {"terms": {"field": "destination.ip"}}}
        ]
      }
    }
  }
}

Common C2 Beacon Intervals

Framework	Default Interval
Cobalt Strike	60 seconds
Metasploit	5 seconds
Empire	5 seconds
Covenant	10 seconds
Sliver	60 seconds