C2 Beacon Pattern Detection - Regular Interval Communication

Ankit Mehta@Secvyn

•updated Jun 25, 2026•1•0•5

This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.