Beaconing Detection with Splunk

Contents

1 🛰️ Beaconing Detection with Splunk

🛰️ Beaconing Detection with Splunk

Category: Threat Detection
Tags: beaconing, Splunk, command and control, network security, SIEM, data exfiltration, MITRE T1071

🧭 What is Beaconing?

Beaconing is the repeated, often periodic communication from an infected machine to a Command and Control (C2) server. This activity is used by malware to check in, receive commands, or exfiltrate data.

While the traffic may look harmless (e.g. HTTP, DNS, or SSL), its timing patterns or destination behaviour can give it away.

🔍 Why Detect Beaconing?

Detecting beaconing is critical because:

It’s an early indicator of compromise
It often precedes data exfiltration or ransomware deployment
It’s a common tactic used by APTs and commodity malware

Splunk, when paired with good data sources (DNS, firewall, proxy, NetFlow), becomes a powerful tool to detect beaconing patterns.

🛠️ Required Data Sources

Source	Use
Firewall Logs	Show outbound traffic patterns and destinations.
DNS Logs	Crucial for detecting DNS-based C2 tunnelling or frequent lookups.
Web Proxy Logs	Reveal frequent HTTP/S connections to external IPs/domains.
NetFlow/sFlow	Good for timing-based anomaly detection (e.g. beacon intervals).
EDR/XDR Logs	Provide endpoint context to match suspicious network activity.

📈 Example Splunk Query – DNS Beaconing

index=dns_logs sourcetype="dns"
| stats count min(_time) as first max(_time) as last by src_ip, query
| eval duration=last - first<br>| where count > 10 AND duration > 300
| sort - count

index=dns_logs sourcetype="dns"
| stats count min(_time) as first max(_time) as last by src_ip, query
| eval duration=last - first<br>| where count > 10 AND duration > 300
| sort - count

This basic query looks for repeated DNS queries over a period (more than 10 queries across 5+ minutes). Tuning depends on your environment.

🧠 Tips for Tuning Beacon Detection

Use timechart to visualise regular intervals: index=proxy_logs url="*" | timechart span=5m count by dest_ip
Look for entropy in domain names (eval entropy=len(domain))
Filter known-good traffic (e.g. Windows Update, antivirus servers)
Leverage threat intelligence to enrich destination IP/domain

🧰 Detection Enhancements

Technique	Description
Machine Learning Toolkit (MLTK)	Use clustering or frequency analysis to catch beacon-like behaviour.
Threat Intelligence Enrichment	Cross-reference with STIX, TAXII, or MISP feeds.
Anomalous Port Use	Look for uncommon outbound connections (e.g. port 443 to dynamic IPs).
MITRE ATT&CK Mapping	Tag detections to techniques like `T1071`, `T1008`, `T1071.004`.

🧬 MITRE ATT&CK Reference

Tactic: Command and Control
Technique: T1071 – Application Layer Protocol
Use Case: Identifying HTTP/HTTPS beaconing to remote C2 servers.

🛡️Latest Security Alerts 🛡️