Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › Beaconing Techniques

Beaconing Techniques

2 min read

Jump to:

Overview

Beaconing techniques involve adversaries establishing periodic communication from compromised systems to external command and control (C2) infrastructure. This technique is critical in maintaining stealthy, persistent access throughout various stages of an attack lifecycle, enabling attackers to receive commands, exfiltrate data, or update malware without raising immediate suspicion.

Attack Objective

Maintain covert communication channels for control and data transfer
Primarily supports Command & Control, Persistence, and Lateral Movement stages
Facilitates ongoing attacker presence and operational flexibility within the target environment

How the Technique Works

Beaconing operates by having compromised hosts send regular, often low-volume signals or requests to attacker-controlled servers. These signals serve as check-ins that indicate system availability and readiness to receive instructions. The timing, frequency, and content of beacon messages can be manipulated to evade detection and blend with normal network traffic.

Common Methods & Variations

Use of HTTP/HTTPS, DNS, ICMP, or custom protocols for beacon transmissions
Implementation across on-premises networks, cloud environments, endpoints, and identity services
Employment of living-off-the-land binaries and legitimate protocols versus custom-developed beaconing tools

Indicators of Compromise (IOCs)

Unusual periodic outbound network connections to rare or suspicious domains or IP addresses
Repetitive DNS queries with uncommon patterns or to newly registered domains
Endpoint logs showing scheduled or recurring processes initiating network activity
Cloud service logs indicating anomalous API calls or data flows consistent with beaconing behavior

Detection Strategies

Network telemetry including flow data, DNS logs, and proxy logs for identifying regular, patterned communications
Behavioral analytics focusing on timing, frequency, and destination anomalies rather than static signatures
Correlation of endpoint process execution with network activity to identify suspicious beaconing processes

Mitigation & Prevention

Network segmentation and egress filtering to restrict unauthorized outbound communications
Enforcement of least privilege and multi-factor authentication to limit attacker persistence
Regular monitoring and updating of allowlists and blocklists for domains and IP addresses

Response Considerations

Immediate isolation of affected systems to disrupt beaconing channels
Comprehensive investigation to identify scope, including lateral movement and data exfiltration paths
Post-incident hardening such as patching, credential resets, and enhanced network monitoring

Related Techniques

Command and Control establishment and maintenance
Persistence mechanisms that enable long-term beaconing
Lateral Movement techniques leveraging beacon signals for coordination

Mapping & References

MITRE ATT&CK: T1071 – Application Layer Protocol, T1095 – Non-Application Layer Protocol, T1105 – Ingress Tool Transfer
Public research on beaconing detection methodologies and C2 communication analysis from cybersecurity organizations and incident reports

Tags: Adversary TTPs ATT&CK Beaconing Command and Control Cybersecurity Techniques lateral movement network security persistence Threat Detection