beaconing-review

Beaconing review

Grade one periodic outbound flow. Extract the facts, apply the first matching rule, and finish with the labelled block. When no tool is callable in this turn, do not announce a lookup and do not stop: reputation is not checked, and the block is still written from the finding alone.

Facts

From raw_data, take src_ip, the destination, dst_port, bytes_sent, bytes_received, and frequency. The destination is dst_ip when that field is present; otherwise dst_host or dst_domain. A domain or IP in iocs does not replace dst_ip. The title and description are where a source labels the flow as C2.

Note the source host's role from src_ip (an RFC 1918 address is an internal client). Role explains who is phoning out. It does not pick the verdict.

Jitter is absent when frequency states one period. "every 60 seconds" and "every 300 seconds" are fixed intervals with no jitter, including when the text itself says "fixed" or "no jitter". A span ("40 to 110 seconds"), or "roughly", "about", or an unnegated "jitter", means jitter is present.

Reputation

Name a tool only when you hold it:

• If you hold recall_entity, call it on the destination before any external lookup.
• If you hold lookup_indicators, query the local feed for that indicator.
• If you hold cf_lookup_ip_threat, use it for an IP. If you hold cf_lookup_domain_threat, use it for a hostname.

A check you could not run is written not checked. Never invent a lookup result. When the destination needs a full enrichment, read ioc-enrichment and follow it. Do not restate that procedure here.

Look-alikes

A fixed interval is normal for every row below. It does not make the flow a beacon. A bare IP is none of these rows. Port 443 or 80 to a bare IP is not an update check. Port 123 to a bare IP is not NTP.

• NTP. Hostname is an NTP pool or vendor time host (pool.ntp.org, time.google.com, time.windows.com, time.cloudflare.com), port 123, payloads small and symmetric (a few dozen bytes each way, including 48 and 48). A fixed 300 second poll with no jitter still matches.
• Update check. Hostname is the vendor's update host (windowsupdate.microsoft.com, update.microsoft.com, download.windowsupdate.com, archive.ubuntu.com), port 80 or 443, client payload small. A fixed interval, including 300 seconds, still matches. Symmetric small payloads match this row too.
• Monitoring agent. Hostname is the vendor's monitor (Datadog, New Relic, Elastic) and payloads are small check-ins on that vendor's usual port.
• Telemetry. Hostname is the vendor's own telemetry host and payloads are small regular posts.