mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
114 lines
4.4 KiB
Markdown
114 lines
4.4 KiB
Markdown
---
|
|
name: hunting-for-command-and-control-beaconing
|
|
description: Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation
|
|
to identify compromised endpoints communicating with adversary infrastructure.
|
|
domain: cybersecurity
|
|
subdomain: threat-hunting
|
|
tags:
|
|
- threat-hunting
|
|
- mitre-attack
|
|
- c2
|
|
- beaconing
|
|
- network-analysis
|
|
- proactive-detection
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
d3fend_techniques:
|
|
- File Metadata Consistency Validation
|
|
- Certificate Analysis
|
|
- Application Protocol Command Analysis
|
|
- Content Format Conversion
|
|
- File Content Analysis
|
|
nist_csf:
|
|
- DE.CM-01
|
|
- DE.AE-02
|
|
- DE.AE-07
|
|
- ID.RA-05
|
|
---
|
|
|
|
# Hunting for Command and Control Beaconing
|
|
|
|
## When to Use
|
|
|
|
- When proactively hunting for compromised systems in the network
|
|
- After threat intel indicates C2 frameworks targeting your industry
|
|
- When investigating periodic outbound connections to suspicious domains
|
|
- During incident response to identify active C2 channels
|
|
- When DNS query logs show unusual patterns to specific domains
|
|
|
|
## Prerequisites
|
|
|
|
- Network proxy/firewall logs with full URL and timing data
|
|
- DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)
|
|
- Zeek/Bro network connection logs or NetFlow data
|
|
- SIEM with statistical analysis capabilities (Splunk, Elastic)
|
|
- Threat intelligence feeds for domain/IP reputation
|
|
|
|
## Workflow
|
|
|
|
1. **Identify Beaconing Characteristics**: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).
|
|
2. **Collect Network Telemetry**: Aggregate proxy logs, DNS queries, and connection metadata for analysis.
|
|
3. **Apply Frequency Analysis**: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).
|
|
4. **Filter Known-Good Traffic**: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).
|
|
5. **Analyze Domain/IP Reputation**: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.
|
|
6. **Investigate Endpoint Context**: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.
|
|
7. **Confirm and Respond**: Validate C2 activity, block communication, and initiate incident response.
|
|
|
|
## Key Concepts
|
|
|
|
| Concept | Description |
|
|
|---------|-------------|
|
|
| T1071 | Application Layer Protocol (HTTP/HTTPS/DNS C2) |
|
|
| T1071.001 | Web Protocols (HTTP/S beaconing) |
|
|
| T1071.004 | DNS (DNS tunneling C2) |
|
|
| T1573 | Encrypted Channel |
|
|
| T1572 | Protocol Tunneling |
|
|
| T1568 | Dynamic Resolution (DGA, fast-flux) |
|
|
| T1132 | Data Encoding in C2 |
|
|
| T1095 | Non-Application Layer Protocol |
|
|
| Beacon Interval | Time between C2 check-ins |
|
|
| Jitter | Random variation in beacon interval |
|
|
| DGA | Domain Generation Algorithm |
|
|
| Fast-Flux | Rapidly changing DNS resolution |
|
|
|
|
## Tools & Systems
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| RITA (Real Intelligence Threat Analytics) | Automated beacon detection in Zeek logs |
|
|
| Splunk | Statistical beacon analysis with SPL |
|
|
| Elastic Security | ML-based anomaly detection for beaconing |
|
|
| Zeek/Bro | Network connection metadata collection |
|
|
| Suricata | Network IDS with JA3/JA4 fingerprinting |
|
|
| VirusTotal | Domain and IP reputation checking |
|
|
| PassiveDNS | Historical DNS resolution data |
|
|
| Flare | C2 profile detection |
|
|
|
|
## Common Scenarios
|
|
|
|
1. **Cobalt Strike Beacon**: HTTP/HTTPS beaconing with configurable sleep time and jitter to malleable C2 profiles.
|
|
2. **DNS Tunneling C2**: Data exfiltration and command receipt via encoded DNS TXT/CNAME queries to attacker-controlled domains.
|
|
3. **Sliver C2 over HTTPS**: Modern C2 framework using HTTPS with configurable beacon intervals and domain fronting.
|
|
4. **DGA-based C2**: Malware generating random domains daily, with adversary registering upcoming domains for C2.
|
|
5. **Legitimate Service Abuse**: C2 over legitimate cloud services (Azure, AWS, Slack, Discord, Telegram).
|
|
|
|
## Output Format
|
|
|
|
```
|
|
Hunt ID: TH-C2-[DATE]-[SEQ]
|
|
Source IP: [Internal IP]
|
|
Source Host: [Hostname]
|
|
Destination: [Domain/IP]
|
|
Protocol: [HTTP/HTTPS/DNS/Custom]
|
|
Beacon Interval: [Average seconds]
|
|
Jitter: [Percentage]
|
|
Connection Count: [Total connections]
|
|
Data Volume: [Bytes sent/received]
|
|
First Seen: [Timestamp]
|
|
Last Seen: [Timestamp]
|
|
Domain Age: [Days]
|
|
TI Match: [Yes/No - source]
|
|
Risk Level: [Critical/High/Medium/Low]
|
|
```
|