How do you detect C2 beaconing?

Detect C2 beaconing by hunting for regular connection intervals (low variance in inter-connection time, even with jitter) to a single destination in proxy/flow logs, matching known-tool JA3/JA3S TLS fingerprints at the network layer, alerting on default named pipes (e.g. Cobalt Strike's msagent_*) on the host, and flagging DNS beaconing where one host resolves many subdomains of a single zone. Because C2 traffic is encrypted and infrastructure disposable, timing and behaviour beat static indicators. Tools like Zeek/RITA, Suricata JA3 rules and SigmaHQ provide vetted starting points.

Detecting C2 Beaconing: Finding Command-and-Control in the Noise

Command-and-control frameworks — Empire, Merlin, Villain, Cobalt Strike, Sliver and Havoc — all need to call home. This pack covers detecting that call: beacon periodicity, TLS fingerprints, named-pipe artifacts and default profiles. Because traffic is encrypted and infrastructure is disposable, behaviour and timing beat static indicators.

Signals at a Glance

Signal	Where	Technique
Regular connection interval + jitter to a single destination	Proxy/flow logs	T1071.001
Known-tool JA3/JA3S TLS fingerprint	Network (Suricata/Zeek)	T1573
Default named pipes (e.g. CS `msagent_`, `status_`)	Sysmon 17/18	T1055
DNS beaconing (high-volume TXT/A to one zone)	DNS logs	T1071.004
Long-lived connection to newly-registered domain	Proxy/flow	T1071

Hunt the Heartbeat

The most durable signal is periodicity. Group outbound connections by source/destination and look for low variance in the inter-connection time — a human browses irregularly, a beacon checks in on a schedule, even with jitter:

// Microsoft Sentinel (KQL) - candidate beacons by low time-delta variance
CommonSecurityLog
| where DeviceVendor in ("Palo Alto Networks","Zscaler","Fortinet")
| order by SourceIP, DestinationIP, TimeGenerated asc
| serialize
| extend delta = datetime_diff('second', TimeGenerated, prev(TimeGenerated))
| where prev(SourceIP) == SourceIP and prev(DestinationIP) == DestinationIP
| summarize beacons = count(), avg_delta = avg(delta), stdev_delta = stdev(delta)
          by SourceIP, DestinationIP
| where beacons > 20 and avg_delta > 30 and stdev_delta < (avg_delta * 0.2)

Fingerprints & Artifacts

Match known-tool JA3/JA3S TLS fingerprints at the network layer, but remember they can be spoofed (Merlin presents an operator-supplied JA3) — combine with timing and destination reputation.
On the host, alert on default named pipes used for peer-to-peer beacons and on process injection into signed processes; hunt for HTTP requests with default profile URIs/user-agents.
Restrict and log DNS; alert on a single internal host resolving many subdomains of one zone (DNS tunneling/beacon).

Vetted sources

Use the Zeek/RITA and ACHunter approaches for beacon timing, Emerging Threats/Suricata JA3 rules, and SigmaHQ for named-pipe and default-profile detections. Validate against your own proxy baselines.

Hunt Command-and-Control

Mjolnir Security helps organisations detect C2 beaconing across network and endpoint telemetry.

Detection EngineeringNetwork DetectionManaged Detection & ResponseThreat HuntingIncident Response

Detection Engineering Building beacon-timing and JA3 detections from your telemetry.
Threat Hunting as a Service Hunting for C2 frameworks and encrypted beacons.
24/7 Incident Response Containment when C2 is detected. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026