C2 Communication Indicators
Beaconing Patterns
- Regular interval connections (e.g., every 60 seconds)
- Jittered intervals (±10-20% randomization)
- Long sleep periods with burst activity
HTTP-Based C2
- Custom User-Agent strings
- Unusual URL paths (
/gate,/panel,/api/check) - POST requests with encoded body data
- Cookie-based data exfiltration
- Non-standard ports (8080, 8443, 4443)
DNS-Based C2
- Long subdomain queries (data encoded in subdomain)
- TXT record queries/responses
- High volume of NX (non-existent) domain queries (DGA)
- DNS over HTTPS (DoH) to bypass monitoring
Encrypted C2
- Self-signed TLS certificates
- Unusual JA3/JA3S fingerprints
- Certificate reuse across domains
- Non-standard TLS ports
Data Encoding
- Base64 in URL parameters or POST body
- XOR with single-byte key
- Custom encoding alphabets
- Compressed (GZIP) then encoded data
Detection Approach
- Identify timing patterns (beacon analysis)
- Look for encoding in request/response
- Check for domain age and reputation
- Analyze TLS certificate details
- Look for data volume asymmetry (large responses, small requests)