DoH Beaconing to Uncommon Resolvers from Non-Browser Process (T1071.004/T1572)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects potential command and control (C2) beaconing activity by identifying non-browser processes that initiate regular, sustained outbound network connections over port 443. It aggregates connection data by hour and calculates metrics such as average frequency and standard deviation to identify consistent, periodic communication patterns characteristic of C2 agents while excluding common legitimate web browsers.