What is beaconing?¶
The practical answer¶
Beaconing is repeated outbound communication from a device or process to a destination at regular or semi-regular intervals.
The key evidential caution¶
The dangerous assumption is that regular communication automatically proves malware.
Legitimate software often checks in periodically for:
Key points¶
- updates
- status reporting
- licensing
- monitoring
- time synchronisation
- cloud services
- remote management
An offender may use beaconing to:
- confirm that access remains active
- receive commands
- submit system information
- request new tasks
- maintain a covert control channel
Evidence to preserve¶
Investigators should preserve:
Key points¶
- source device and process
- destination
- timestamps
- interval pattern
- protocol
- request and response size
- DNS activity
- user-agent or application details
- what activity followed
Highly regular timing may suggest automation, but not necessarily malicious automation.
Irregular timing does not exclude command and control because some tools deliberately vary their interval.
Compare the traffic with known software, organisational baselines and endpoint process evidence.
A connection that occurs every five minutes from a known update service may be routine.
A similar pattern from an unknown process after malware execution may be more significant.
Evidential limits¶
Do not assume that the destination IP address identifies the offender. It may be a shared service, compromised host or cloud platform.
Where timing appears regular, calculate the interval over a sufficiently long period. A short extract can create a false impression of regularity or hide deliberate variation. Also compare whether several devices beacon on the same schedule, which may support common configuration or deployment.
Operational takeaway¶
Use timing patterns to identify possible beaconing, then link the traffic to the responsible process, purpose and later activity before calling it malicious command and control.