SystemBC SOCKS5 Beacon: Non-standard Port High-freq Outbound with Timing Jitter Analysis
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
Splunk (SPL)
