C2 and beaconing: the command channel

February 19, 2025 · 1 min read · #malware #c2 #detection

After compromise, the implant (agent/beacon) must receive commands. Command & Control is the channel; the attacker's challenge is to not look anomalous.

How it hides

The beacon contacts the server at regular intervals with jitter (random variation) to avoid being periodic. The channel mimics legitimate traffic: HTTPS to credible domains, domain fronting, DNS tunneling, or legit cloud services (Slack, GitHub) as dead drops. Cobalt Strike's malleable profile shapes requests to look normal.

every ~60s ± jitter:  GET /api/v2/status  (really: fetch task)
                      POST /submit        (really: exfil output)

Defence

Beaconing analysis: regular connections to the same host, anomalous JA3/TLS fingerprints, suspicious volumes and timing. TLS-inspecting proxies, DNS monitoring for tunneling, threat intel on C2 domains. Regularity is the beacon's Achilles heel.

« back to home