[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FMTS3HJB6V37ATA7CRA88":3,"skill-same:01M71FMTS3HJB6V37ATA7CRA88":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":6,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M71FMTS3HJB6V37ATA7CRA88","flow-c2beaconing-detect",null,"Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fflow\u002Fc2beaconing\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"detect","flow c2beaconing detect","flow","network","communicating","threat-hunting","read","command","de","hunting","jitter","beaconing","mitre-attack","conversion","analysis","Bash","cybersecurity","traffic","content analysis","cm","2026-11-10 10:12:30",false,"---\nname: flow-c2beaconing-detect\ndescription: Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- c2\n- beaconing\n- network-analysis\n- proactive-detection\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Certificate Analysis\n- Application Protocol Command Analysis\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1071\n- T1071.001\n- T1562.004\ncapec: []\n---\n\n# Hunting for Command and Control Beaconing\n\n## When to Use\n\n- When proactively hunting for compromised systems in the network\n- After threat intel indicates C2 frameworks targeting your industry\n- When investigating periodic outbound connections to suspicious domains\n- During incident response to identify active C2 channels\n- When DNS query logs show unusual patterns to specific domains\n\n## Prerequisites\n\n- Network proxy\u002Ffirewall logs with full URL and timing data\n- DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)\n- Zeek\u002FBro network connection logs or NetFlow data\n- SIEM with statistical analysis capabilities (Splunk, Elastic)\n- Threat intelligence feeds for domain\u002FIP reputation\n\n## Workflow\n\n1. **Identify Beaconing Characteristics**: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).\n2. **Collect Network Telemetry**: Aggregate proxy logs, DNS queries, and connection metadata for analysis.\n3. **Apply Frequency Analysis**: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).\n4. **Filter Known-Good Traffic**: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).\n5. **Analyze Domain\u002FIP Reputation**: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.\n6. **Investigate Endpoint Context**: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.\n7. **Confirm and Respond**: Validate C2 activity, block communication, and initiate incident response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071 | Application Layer Protocol (HTTP\u002FHTTPS\u002FDNS C2) |\n| T1071.001 | Web Protocols (HTTP\u002FS beaconing) |\n| T1071.004 | DNS (DNS tunneling C2) |\n| T1573 | Encrypted Channel |\n| T1572 | Protocol Tunneling |\n| T1568 | Dynamic Resolution (DGA, fast-flux) |\n| T1132 | Data Encoding in C2 |\n| T1095 | Non-Application Layer Protocol |\n| Beacon Interval | Time between C2 check-ins |\n| Jitter | Random variation in beacon interval |\n| DGA | Domain Generation Algorithm |\n| Fast-Flux | Rapidly changing DNS resolution |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| RITA (Real Intelligence Threat Analytics) | Automated beacon detection in Zeek logs |\n| Splunk | Statistical beacon analysis with SPL |\n| Elastic Security | ML-based anomaly detection for beaconing |\n| Zeek\u002FBro | Network connection metadata collection |\n| Suricata | Network IDS with JA3\u002FJA4 fingerprinting |\n| VirusTotal | Domain and IP reputation checking |\n| PassiveDNS | Historical DNS resolution data |\n| Flare | C2 profile detection |\n\n## Common Scenarios\n\n1. **Cobalt Strike Beacon**: HTTP\u002FHTTPS beaconing with configurable sleep time and jitter to malleable C2 profiles.\n2. **DNS Tunneling C2**: Data exfiltration and command receipt via encoded DNS TXT\u002FCNAME queries to attacker-controlled domains.\n3. **Sliver C2 over HTTPS**: Modern C2 framework using HTTPS with configurable beacon intervals and domain fronting.\n4. **DGA-based C2**: Malware generating random domains daily, with adversary registering upcoming domains for C2.\n5. **Legitimate Service Abuse**: C2 over legitimate cloud services (Azure, AWS, Slack, Discord, Telegram).\n\n## Output Format\n\n```\nHunt ID: TH-C2-[DATE]-[SEQ]\nSource IP: [Internal IP]\nSource Host: [Hostname]\nDestination: [Domain\u002FIP]\nProtocol: [HTTP\u002FHTTPS\u002FDNS\u002FCustom]\nBeacon Interval: [Average seconds]\nJitter: [Percentage]\nConnection Count: [Total connections]\nData Volume: [Bytes sent\u002Freceived]\nFirst Seen: [Timestamp]\nLast Seen: [Timestamp]\nDomain Age: [Days]\nTI Match: [Yes\u002FNo - source]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Hunting for Command and Control Beaconing\n\n## When to Use\n\n- When proactively hunting for compromised systems in the network\n- After threat intel indicates C2 frameworks targeting your industry\n- When investigating periodic outbound connections to suspicious domains\n- During incident response to identify active C2 channels\n- When DNS query logs show unusual patterns to specific domains\n\n## Prerequisites\n\n- Network proxy\u002Ffirewall logs with full URL and timing data\n- DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)\n- Zeek\u002FBro network connection logs or NetFlow data\n- SIEM with statistical analysis capabilities (Splunk, Elastic)\n- Threat intelligence feeds for domain\u002FIP reputation\n\n## Workflow\n\n1. **Identify Beaconing Characteristics**: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).\n2. **Collect Network Telemetry**: Aggregate proxy logs, DNS queries, and connection metadata for analysis.\n3. **Apply Frequency Analysis**: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).\n4. **Filter Known-Good Traffic**: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).\n5. **Analyze Domain\u002FIP Reputation**: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.\n6. **Investigate Endpoint Context**: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.\n7. **Confirm and Respond**: Validate C2 activity, block communication, and initiate incident response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071 | Application Layer Protocol (HTTP\u002FHTTPS\u002FDNS C2) |\n| T1071.001 | Web Protocols (HTTP\u002FS beaconing) |\n| T1071.004 | DNS (DNS tunneling C2) |\n| T1573 | Encrypted Channel |\n| T1572 | Protocol Tunneling |\n| T1568 | Dynamic Resolution (DGA, fast-flux) |\n| T1132 | Data Encoding in C2 |\n| T1095 | Non-Application Layer Protocol |\n| Beacon Interval | Time between C2 check-ins |\n| Jitter | Random variation in beacon interval |\n| DGA | Domain Generation Algorithm |\n| Fast-Flux | Rapidly changing DNS resolution |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| RITA (Real Intelligence Threat Analytics) | Automated beacon detection in Zeek logs |\n| Splunk | Statistical beacon analysis with SPL |\n| Elastic Security | ML-based anomaly detection for beaconing |\n| Zeek\u002FBro | Network connection metadata collection |\n| Suricata | Network IDS with JA3\u002FJA4 fingerprinting |\n| VirusTotal | Domain and IP reputation checking |\n| PassiveDNS | Historical DNS resolution data |\n| Flare | C2 profile detection |\n\n## Common Scenarios\n\n1. **Cobalt Strike Beacon**: HTTP\u002FHTTPS beaconing with configurable sleep time and jitter to malleable C2 profiles.\n2. **DNS Tunneling C2**: Data exfiltration and command receipt via encoded DNS TXT\u002FCNAME queries to attacker-controlled domains.\n3. **Sliver C2 over HTTPS**: Modern C2 framework using HTTPS with configurable beacon intervals and domain fronting.\n4. **DGA-based C2**: Malware generating random domains daily, with adversary registering upcoming domains for C2.\n5. **Legitimate Service Abuse**: C2 over legitimate cloud services (Azure, AWS, Slack, Discord, Telegram).\n\n## Output Format\n\n```\nHunt ID: TH-C2-[DATE]-[SEQ]\nSource IP: [Internal IP]\nSource Host: [Hostname]\nDestination: [Domain\u002FIP]\nProtocol: [HTTP\u002FHTTPS\u002FDNS\u002FCustom]\nBeacon Interval: [Average seconds]\nJitter: [Percentage]\nConnection Count: [Total connections]\nData Volume: [Bytes sent\u002Freceived]\nFirst Seen: [Timestamp]\nLast Seen: [Timestamp]\nDomain Age: [Days]\nTI Match: [Yes\u002FNo - source]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":35,"maxTurns":54,"nist_csf":55,"subdomain":24,"description":7,"mitre_attack":60,"d3fend_techniques":65},[24,31,45,30,46,47],"c2","network-analysis","proactive-detection",[],"sonnet",[51,34,52,53],"Read","Glob","Grep",20,[56,57,58,59],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[61,62,63,64],"T1059","T1071","T1071.001","T1562.004",[66,67,68,69,70],"File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fflow\u002Fc2beaconing\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill flow-c2beaconing-detect",{"tool":84,"command":85},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill flow-c2beaconing-detect",{"tool":87,"command":88},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill flow-c2beaconing-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fflow\u002Fc2beaconing\u002Fdetect\u002FSKILL.md",true,[92],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"index.json","REFERENCE","参考文档",676,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fflow\u002Fc2beaconing\u002Fdetect\u002Findex.json",[99,121,139,160,182,198],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[106,19,107,108,109,27,38,110,111,112,113,114,115,116,117,118,119,35,120],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[128,106,129,108,130,131,36,35,34,33,132,133,134,135,27,26,136,25,137,138],"exploit","services wmi exec exploit","exec","remote","team","across","crackmapexec","native","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,35,34,152,33,153,154,27,25,155,156,157,158,159,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[19,167,168,169,170,171,172,38,173,35,120,174,175,176,177,178,179,180,181,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,19,191,169,171,192,38,193,173,35,120,33,194,195,196,197,181,27,110],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,19,169,206,192,38,207,208,35,120,209,210,211,212,213,214,27,110,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]