mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-16 20:55:17 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
109 lines
2.6 KiB
Markdown
109 lines
2.6 KiB
Markdown
# API Reference: Beaconing Detection via Frequency Analysis
|
|
|
|
## Beaconing Characteristics
|
|
|
|
| Characteristic | Description |
|
|
|---------------|-------------|
|
|
| Regular intervals | Connections at fixed time periods |
|
|
| Low jitter | Small variance in intervals |
|
|
| Persistent | Continues over hours/days |
|
|
| Consistent size | Similar packet sizes |
|
|
|
|
## Jitter Calculation
|
|
|
|
### Standard Deviation of Intervals
|
|
```python
|
|
import math
|
|
intervals = [t[i+1] - t[i] for i in range(len(t)-1)]
|
|
mean = sum(intervals) / len(intervals)
|
|
variance = sum((x - mean)**2 for x in intervals) / len(intervals)
|
|
jitter = math.sqrt(variance)
|
|
jitter_percent = (jitter / mean) * 100
|
|
```
|
|
|
|
### Jitter Thresholds
|
|
| Jitter % | Confidence | Likely Cause |
|
|
|----------|------------|--------------|
|
|
| < 5% | HIGH | Automated C2 beacon |
|
|
| 5-15% | MEDIUM | Possible C2 with sleep jitter |
|
|
| 15-30% | LOW | May be legitimate polling |
|
|
| > 30% | NONE | Likely human/random |
|
|
|
|
## Zeek conn.log Format
|
|
|
|
### Fields
|
|
| Index | Name | Description |
|
|
|-------|------|-------------|
|
|
| 0 | ts | Unix timestamp |
|
|
| 2 | id.orig_h | Source IP |
|
|
| 3 | id.orig_p | Source port |
|
|
| 4 | id.resp_h | Destination IP |
|
|
| 5 | id.resp_p | Destination port |
|
|
| 6 | proto | Protocol |
|
|
| 9 | orig_bytes | Sent bytes |
|
|
| 10 | resp_bytes | Received bytes |
|
|
|
|
## RITA (Real Intelligence Threat Analytics)
|
|
|
|
### Analyze Zeek Logs
|
|
```bash
|
|
rita import /path/to/zeek/logs dataset_name
|
|
rita show-beacons dataset_name
|
|
```
|
|
|
|
### Output Columns
|
|
| Column | Description |
|
|
|--------|-------------|
|
|
| Score | Beacon probability (0-1) |
|
|
| Source | Source IP |
|
|
| Destination | Destination IP |
|
|
| Connections | Total connections |
|
|
| Avg Bytes | Average data transfer |
|
|
|
|
## Splunk SPL — Beacon Detection
|
|
|
|
```spl
|
|
index=network sourcetype=zeek:conn
|
|
| bin _time span=60s
|
|
| stats count by src_ip, dest_ip, dest_port, _time
|
|
| streamstats window=100 stdev(count) as jitter avg(count) as avg_count by src_ip, dest_ip
|
|
| where jitter/avg_count < 0.15
|
|
| stats count as beacon_count by src_ip, dest_ip, dest_port
|
|
| where beacon_count > 100
|
|
```
|
|
|
|
## Elastic SIEM — Beacon Detection
|
|
|
|
```json
|
|
{
|
|
"query": {
|
|
"bool": {
|
|
"must": [
|
|
{"range": {"@timestamp": {"gte": "now-24h"}}},
|
|
{"exists": {"field": "destination.ip"}}
|
|
]
|
|
}
|
|
},
|
|
"aggs": {
|
|
"by_flow": {
|
|
"composite": {
|
|
"sources": [
|
|
{"src": {"terms": {"field": "source.ip"}}},
|
|
{"dst": {"terms": {"field": "destination.ip"}}}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
## Common C2 Beacon Intervals
|
|
|
|
| Framework | Default Interval |
|
|
|-----------|-----------------|
|
|
| Cobalt Strike | 60 seconds |
|
|
| Metasploit | 5 seconds |
|
|
| Empire | 5 seconds |
|
|
| Covenant | 10 seconds |
|
|
| Sliver | 60 seconds |
|