What is beaconing?

What is beaconing?

Beaconing is the habit malware has of calling home. After it lands on a host, the implant contacts its command-and-control (C2) server on a schedule to report that it is alive and to ask whether the attacker has new tasks. Each check-in is a beacon. Most of the time the answer is that there is nothing to do yet, so a beacon is usually a small request followed by a small reply, repeated for hours or days. That regularity is what gives it away.

Sleep, jitter and channel

• Sleep interval: the time between check-ins. Intervals of a few seconds give the attacker a near-interactive session; intervals of several hours are much quieter.
• Jitter: random variation added to the interval so the timing is not perfectly even. A 60-second sleep with 20 percent jitter might produce gaps of 51, 66, 49 and 70 seconds.
• Channel: usually HTTPS to blend in with web traffic, sometimes DNS queries, and sometimes legitimate cloud services the organization already allows.

Attack frameworks, whether criminal tools or the commercial ones red teams use, let operators set all three.

Beaconing in the logs

Web proxy entries for one workstation, filtered to a single destination, look like this:

The gaps vary between 52 and 71 seconds, but the request, the sizes and the destination never change, and the pattern runs all night while the user is at home. At about one check-in a minute, a host makes roughly 1,440 connections a day to that destination (86,400 seconds divided by 60). Human browsing looks nothing like that: bursts of requests to many sites while someone works, then silence.

How beaconing is detected

• Interval analysis: group connections by source and destination, then measure how regular the gaps are. Low variation sustained over many hours scores as likely beaconing, even with jitter.
• Size consistency: near-identical request and response sizes across hundreds of connections.
• Destination context: newly registered domains, low-reputation hosting, rare destinations that only one or two internal hosts ever contact, and matches on threat feeds.
• Data sources: NetFlow or IPFIX records, proxy and firewall logs, DNS logs and, where TLS inspection is permitted, the content itself.

The open-source tool RITA analyzes Zeek network logs for these patterns, and many SIEM and network detection products include beacon scoring.

False positives and response

Plenty of legitimate software checks in on a timer too: update services, antivirus signature downloads, NTP, monitoring agents, cloud sync clients and telemetry. Keep an allow list of known periodic destinations so analysts only see the unexplained ones. When a beacon is confirmed, find the process behind it with EDR, isolate the host, block the destination at the proxy and DNS layers, and search for the same destination or timing pattern on other hosts. Blocking alone isn't enough, because many implants carry a backup channel.

Beaconing vs. related activity

• Command and control: the whole channel; beaconing is the periodic check-in pattern on it.
• Data exfiltration: large outbound transfers rather than small, regular ones.
• DNS tunneling: data carried inside DNS queries, which can also beacon.
• Port scanning: one host probing many ports or addresses, not one destination over and over.

Beaconing on the CompTIA Security+ exam

Beaconing is one of the network signs of malicious activity under SY0-801 objective 2.5. It comes back with flow data and monitoring under objective 4.4 and with investigation data sources under objective 4.8. Wording such as "connects to the same external address every 60 seconds", "small, regular outbound connections around the clock" or "periodic traffic to a newly registered domain" points to beaconing and a compromised host talking to C2. Distractors include data exfiltration (large transfers), a DDoS attack, a port scan and normal software updates. The usual first response is to isolate the host and investigate.