Cross-Platform C2 Detection via Suricata and Elastic Defend Correlation

This detection framework enables security teams to correlate network security alerts from Suricata with host-level process execution data captured by Elastic Defend. By linking network-layer indicators, such as application-layer protocol anomalies or non-standard port usage, to the specific process ID and executable responsible for the traffic, analysts can reduce noise and improve the accuracy of command and control (C2) detection. This capability is cross-platform, supporting Windows, Linux, and macOS environments. The methodology is designed to identify beaconing or unauthorized network discovery activity that would otherwise remain siloed within network logs, allowing defenders to pinpoint the exact source process, path, and command-line parameters associated with flagged network traffic.

Impact

Successful implementation of this detection strategy allows for the identification of previously obscured C2 and discovery activity, limiting the potential for long-term persistence, data exfiltration, and unauthorized lateral movement by adversaries within the enterprise network.

Recommendation

• Deploy the correlation logic to link Suricata alert events (logs-suricata.*) with Elastic Defend network events (logs-endpoint.events.network-*) within the SIEM environment.
• Establish a baseline for legitimate network-initiating processes to tune out administrative tools like PDQ Inventory and other authorized management software.
• Prioritize alerts involving destination IPs with poor reputation scores or those exhibiting unexpected beaconing behavior.
• Use the correlated process metadata (command_line, user, and parent process context) to rapidly triage the host-side origin of suspicious network connections.