HTTP Beaconing Pattern

Use case development / Monitor Network Anomalies / Detect C2 Communications

sigma

Detection rule

title: HTTP Beaconing Detection
status: experimental
description: Detects regular HTTP callbacks indicating C2 beaconing
logsource:
  product: proxy
detection:
  selection:
    http_method: 'GET'
  condition: selection | count() by src_ip, dest_host > 50 and stddev(timestamp) < 60
  timeframe: 1h
falsepositives:
  - Software update checks
  - Monitoring agents
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001

Test cases

• Generate regular HTTP requests every 60 seconds

False positive guidance

Baseline legitimate periodic traffic like updates.

Detection course