C2 Beaconing Detection (ASIM)
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns: 1) Periodic beaconing with low jitter 2) Long-lived HTTP(S) long-polling sessions 3) Network traffic with very consistent payload sizes Such patterns can indicate covert communication with compromised systems or malware infections.
Microsoft Sentinel (KQL)
