High Confidence Command and Control Beaconing Detected by Statistical Model

This brief describes an Elastic Security detection rule designed to identify command-and-control (C2) beaconing activity with high confidence using a statistical model. C2 beaconing is a critical technique used by adversaries to maintain covert communication channels with compromised systems, enabling them to receive instructions, deploy additional payloads, exfiltrate sensitive data, and ensure persistence within a targeted network. The detection leverages Elastic's Network Beaconing Identification integration, which employs a statistical framework to analyze network logs and assign a beaconing score. A high score, specifically a beacon_stats.beaconing_score of 3, indicates a strong likelihood of malicious C2 activity. This detection capability requires the Elastic Defend integration for network log collection and a Fleet Server for the Network Beaconing Identification integration.

Attack Chain

This brief describes a detection mechanism for command-and-control beaconing, not a full attack chain from initial access to impact. The detection occurs during the command and control phase of an attack.

Impact

If C2 beaconing activity goes undetected, attackers can maintain a persistent foothold within the network, allowing for sustained control over compromised systems. This can lead to significant data exfiltration, deployment of further malicious payloads (such as ransomware or destructive malware), privilege escalation, and lateral movement across the organization's infrastructure. The long-term presence enabled by effective C2 communication can result in severe financial loss, reputational damage, and operational disruption.

Recommendation

• Deploy the Network Beaconing Identification integration and Elastic Defend to collect the necessary network logs for the detection rule.
• Review the network traffic logs from the ml_beaconing.all index to investigate the source and destination IP addresses associated with detected beaconing activity.
• Correlate identified IP addresses and domain names with known malicious IP databases or threat intelligence feeds.
• Analyze the frequency and pattern of beaconing activity to assess alignment with typical C2 communication patterns.
• Examine payloads or data transferred during flagged communication sessions for sensitive information exfiltration or malicious instructions.
• Consult the investigation guide provided in the source material for detailed triage steps.
• Isolate affected systems from the network to prevent further communication with C2 servers and contain the threat.
• Conduct thorough analysis of network traffic logs to identify additional compromised systems or lateral movement within the network.
• Apply security patches and updates to all affected systems and change all associated credentials to prevent unauthorized access.