Network Connection Jitter Analysis for Command and Control
This rule detects suspicious network communication patterns indicative of command and control (C2) activity by analyzing the jitter (variability) in connection gaps and byte transfer sizes. It identifies connections with a high number of events, a consistent average gap between connections, and low jitter in both connection timing and data transfer sizes (bytes out and bytes in). This pattern can suggest automated, scheduled communication often associated with C2 channels.
Splunk (SPL)
