C2 beacons give themselves away by the clock

The scenario is fictional (RFC 5737 IPs). Aggregations were tested on synthetic data.

Humans don't connect to the same host exactly every 60 seconds. Malware coded to "phone home every minute" does. That regularity is a footprint.

What you'll learn

• The timing signature of beacons
• A tested standard-deviation one-liner
• Finding exfiltration in the same log
• Telling it from monitoring and updates

The story at a glance

02:24 the payload starts on web03; from 02:25 it sends small, nearly regular requests to 198.51.100.5:443; the alert fires at 02:41.

The idea

For each (source, destination) pair, measure the gaps between connections. Humans: scattered (large standard deviation). Beacons: near constant (small), even with some jitter.

sort -n conn.tsv | awk '$4==443 {
  k=$2" "$3
  if (prev[k]) { d=$1-prev[k]; s[k]+=d; q[k]+=d*d; n[k]++ }
  prev[k]=$1 }
END { for (k in n) { m=s[k]/n[k]; sd=sqrt(q[k]/n[k]-m*m); printf "%.1f %.1f %d %s\n", sd, m, n[k], k } }' | sort -n

Columns: ts src dst port, output stddev mean count pair, smallest deviation first. On synthetic data (60 s +/- 1 s beacon vs. irregular human traffic) the beacon came first with deviation < 2 s and mean about 60 s; the human pair exceeded 10 s.

Exfiltration

zeek-cut id.orig_h id.resp_h id.resp_p orig_bytes resp_bytes conn_state < conn.log \
 | awk '$2 !~ /^10\./ && $4+0 > 10000000 {print}'

(Book command; not run here.) On Windows, use WFP 5156 timestamps with PowerShell for the same statistics.

False positives

Monitoring agents, update checks and NTP are regular too. Don't call "regular" bad: combine regular x unknown destination x a host that shouldn't talk out (for example a public web server).

Defense

Allow-list outbound traffic from public servers and keep flow/proxy/DNS logs off-host.

Next: the knock before the lateral move.

---

Adapted from chapters 17, 18 and 20 of my Japanese book on server defense.