What is Beaconing?

July 4, 2022

Topics

Cybersecurity
Threat Hunting

It’s evident that cybersecurity professionals can’t defeat adversaries by relying solely on SIEM solutions. Traditionally, a lot of focus was placed on SIEM solutions as a tool to detect anomalous activities based on its signature matching technique, but this approach is becoming antiquated as APTs are using more sophisticated attacks to gain access to systems.

As adversaries keep finding new ways to hide their presence in a network, defenders must also adopt new techniques to detect threats that masquerade as normal network activity. One way to achieve this goal is by detecting C2 beaconing.

Beaconing

In the context of malware, beaconing is a communication channel between a C2 server and malware on an infected host. It typically takes place once an attacker has gained access to a network. Once a host is compromised, it acts as a node that awaits instructions from its C2 server to gather intelligence about the environment it’s in. Once the beacon malware is deployed, it will run in memory to evade anti-virus detection and send an encrypted traffic signal known as a heartbeat to its C2 server. By relying on the heartbeat, attackers can keep the communication channel open and send commands or payloads to perform malicious tasks and further their infection chain.

Characteristics and Behaviors

Time Interval - A beacon that is deployed as malware is essentially a program that is designed to send traffic at a specific interval set by threat actors. It generates traffic repeatedly over a period of time as a way to notify that the communication channel is open. The typical sequence that follows this trait is that a beacon will initially send a heartbeat and go to “sleep” mode for a set amount of time only to wake up and repeat the same process. This means that beacons constantly maintain a connection with the attacker’s infrastructure without having to renegotiate a new communication channel.

Packet Size - Another way to detect beaconing is by looking at the packet size each session generates. As noted in the above, malware will attempt to send a heartbeat at a time interval configured by the adversary and each connection will typically result in the identical amount of data being exchanged.

Jitter - The above traits are key factors in detecting beacons, but they must be observed with a trained eye. Although beacons behave the same way, they exhibit various sleep time and packet size depending on environmental conditions, making it hard for threat hunters to detect. For example, if adversaries are well informed about an organization’s security posture, they may increase the time interval to avoid triggering detection. In addition, beacons nowadays integrate a time-delay technique called “jitter” which adds randomness and deviation to the time interval. This variance technique is used by malware as a part of its mechanism to evade detection.

Strategy

In order to track down beacons, cybersecurity professionals should gather as much data as possible over a period of time and eliminate benign protocols used by NTP or services like Twitter. Once the dataset is trimmed, the next step is to implement several filtering rules. The rules may include selecting a group of internal hosts to monitor and recording the number of connections and time delta generated between the hosts and suspicious domains. If an enterprise has a large network, it’s still recommended to select several hosts rather than all the hosts since beacons are only likely to infect a few hosts at a time. Once sufficient data is gathered, deep analysis should be performed to threat hunt.

Conclusion

In this article, we have discussed beacon characteristics and what we can look for during threat hunting. The most effective way to detect artifacts such as beacons is to assume that a breach has already occurred and implement an effective strategy that requires an honest assessment of the relevant data. Looking at data through this lens allows for identifying evidence more quickly to determine whether adversaries are lurking in your network.

What is Beaconing?

Beaconing

Characteristics and Behaviors

Strategy

Conclusion

Up Next

Black Cat Attack on UnitedHealth Group

Chinese Hackers Exploit FortiOS Vulnerability