Persistent beaconing to external hosts over ports 80/443 consistent with tunneled UNC1549 C2

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•4

This rule detects persistent, long-lived outbound network connections from a single device to external public IP addresses over common web ports (80 and 443). By calculating the connection count, total duration, and average interval between connections, it identifies periodic beaconing activity consistent with command and control (C2) communication patterns, such as those observed in UNC1549 TRUSTRAP traffic.