Skip to the main content.
Partner Programs
Technology Partners
Featured Report


3 min read

Advanced Threat Hunting: Detecting Beaconing Attacks

Detecting Beaconing Attacks by Advanced Threat Hunting


Beaconing attacks can be difficult—but not impossible—to detect. The more you know about these stealthy attacks, the better you’ll be able to uncover and respond to them.  

What is beaconing?

Command-and-control (C2) beaconing is a type of malicious communication between a C2 server and a suspicious program on an infected host. C2 servers can orchestrate a number of different nefarious attacks — for example, denial-of-service (DoS), ransomware, or data exfiltration attacks.


How does a beaconing attack work?

The goal of a beaconing attack is system access. To succeed, an attacker generates multiple data packets, known as beacons, over the network. Based on the attack type, these packets can contain malicious code or requests for data from the target system.

Beaconing attacks can be difficult to detect and respond to as they are sent in small chunks with multiple groups. Moreover, because adversaries can gradually expand access into a targeted system over time, they can remain undetected for longer periods of time.

Though traffic beaconing looks similar to normal network traffic, it does have some unique characteristics with respect to timing and packet size. Thus, it’s possible for organizations to use modelling, standard statistical, and signal organization techniques to detect beaconing.


Beaconing attack scenario

Attack Scenario

Group 1
Group 2
  • Source IP :- (Some Public IP)
  • Beaconing Pattern: - 1,2,3 ( These are cluster of events)
  • AVG_Count_Events Per Seconds : 1.54
  • Number_Of_Beacon_Attempt: - 971
  • Beacon_Attempt: - [3 , 2023-07-07 04:36:56+00] --> 3 Events Observed on 2023-07-07 04:36:56 this time.
  • Sleep Duration: - 8 Seconds (identified) & random time frame.
  • Source IP :- (Some Public IP)
  • Beaconing Pattern: - 1,2,3,4,5,6,7 ( These are cluster of events)
  • AVG_Count_Events Per Seconds : 3.51
  • Number_Of_Beacon_Attempt: - 435
  • Beacon_Attempt:- [5 , 2023-06-07 21:33:41+00] --> 5 Events Observed on 2023-06-07 21:33:41+00 this time.
  • Sleep Duration: - 2 Seconds (Identified) & random time frame.


Description: Group 2 shows that the attack generates five (5) events per second. Between intervals, the sleep time is two (2) seconds. We have observed many types of beaconing attempts.

Attack pattern 

For each group of beaconing events, traffic will be blocked and then, it will be allowed at only one time.


Threat hunting for beaconing attacks

Source Look for the same IP. In some scenarios, check for the same subnet of IP. E.g., Subnet Total number of events between source and destination
Destination_Address (Service)
AVG_Count_Events Per Second Average number of events per second should be <=2 for each source to destination.
If the average count of events is => 2, it is a non-human effort. In this case, check for pattern, bytes, destination, user agent, URL, target port, and total number of events.
Pattern of Communication
For each pattern of communication please hunt for how many such sets are getting generated.
For example, for each second, three (3) requests are generated, and 10 sets are observed for such transactions.
More sets mean it is easy to detect. If sets are random, it’s more difficult.
For example, 1,2,3 for each second 1 request generated with five (5) sets, but in between, other sets are coming.
Consider, three (3) event sets are generated every second, but in between, there is a random set of more than three (3) events.
3 (1) -- 2 (1) -- 4 (2) -- 3 (2)
3 sets (1event) -- 2 sets (1 event) -- 4 sets (2 events) -- 3 sets (2 events)
Sleep Duration It is a gap of two (2) groups that are generating similar pattern of events. The longer the sleep duration, the more difficult it is to detect.
Bytes In / Bytes Out
Hunt for scenarios:
1. The same number of bytes in as bytes out.

2. With a persistent number of bytes out or bytes in communication.

3. A progressive increase in bytes transaction.
Many devices don’t give byte information. In these cases, packet analysis is useful.


Screenshot from BigQuery result

Threat hunting using detection of beaconing attacks


Impact of findings 

The impact of beaconing with circumvention of control can be severe. If attackers can beacon from a compromised system, they can infiltrate any potential payload to access sensitive data and information about the network. They can also use the compromised system as a launchpad for further attacks. 


Recommendations for detecting and responding to beaconing attacks

Beaconing attacks are difficult to detect because of the crafting of packets, frequency in which they can be modeled. One of the best ways to detect a beaconing attack is by analyzing a long trail of data so that threat hunters can uncover patterns of communications. Block the IPs and find all the suspicious communication from the Google Chronicle search window.

To learn more about new attacks and threats, visit Netenrich Knowledge Now and subscribe for daily threat news and alerts.


Netenrich Adaptive MDR™: Not Your Average MDR Solution

Netenrich Adaptive MDR™: Not Your Average MDR Solution

“In cybersecurity, the only constant is change.” This age-old adage continues to ring true as organizations navigate a shifting threat landscape with...

Read More
Red CryptoApp: A New Threat Group in the Ransomware World

Red CryptoApp: A New Threat Group in the Ransomware World

This is a preliminary report based only on the data leak site (DLS), listed victims, and other observed patterns. A detailed investigation will...

Read More
Netenrich Earns Google Cloud SecOps Service Delivery Expertise Certification

Netenrich Earns Google Cloud SecOps Service Delivery Expertise Certification

As the first, exclusive pure-play Google Chronicle SecOps partner, Netenrich is 100% committed to the Chronicle SecOps and Mandiant technology...

Read More