Network Beaconing Detection - C2
This rule detects potential network beaconing activity by analyzing network connection events. It identifies repetitive outbound connections from a device to a remote IP and port with a consistent time interval (low jitter). The rule filters out known legitimate processes and domains to reduce false positives. It calculates the average time delta between connections, standard deviation, and interquartile range to identify beacon-like patterns. The rule also considers the number of unique devices connecting to the same remote endpoint to identify potentially compromised infrastructure.
Microsoft Sentinel (KQL)
