C2 Beacon Detector
A command and control beacon detection tool written in Elixir, demonstrating functional programming and pattern matching for network traffic analysis.
NullSec BeaconHunt analyzes network connections to identify command and control (C2) beacon patterns. It detects regular communication intervals, DNS tunneling, and covert channels with confidence scoring.
- Beacon Pattern Detection - Identify regular callback intervals
- Jitter Analysis - Measure timing variations
- DNS Tunneling - Detect DNS-based C2
- Protocol Classification - HTTP, HTTPS, DNS, ICMP
- Confidence Scoring - Probabilistic detection
- MITRE ATT&CK - Technique mapping
| Beacon Type | Protocol | MITRE | Description |
|---|---|---|---|
| HTTP Beacon | TCP/80 | T1071.001 | Web-based C2 |
| HTTPS Beacon | TCP/443 | T1071.001 | Encrypted web C2 |
| DNS Beacon | UDP/53 | T1071.004 | DNS tunneling |
| ICMP Beacon | ICMP | T1095 | Ping-based covert channel |
| Custom | Various | T1095 | Non-standard protocols |
# Clone the repository
git clone https://github.com/bad-antics/nullsec-beaconhunt
cd nullsec-beaconhunt
# Run with Elixir
elixir beaconhunt.exs
# Or compile with Mix
mix escript.build
./beaconhunt# Analyze PCAP file
elixir beaconhunt.exs capture.pcap
# Live capture
elixir beaconhunt.exs -i eth0
# Set confidence threshold
elixir beaconhunt.exs -t 0.7 traffic.pcap
# JSON output
elixir beaconhunt.exs -j capture.pcap
# Run demo
elixir beaconhunt.exs╔══════════════════════════════════════════════════════════════════╗
║ NullSec BeaconHunt - C2 Beacon Detector ║
╚══════════════════════════════════════════════════════════════════╝
[Demo Mode]
Analyzing sample network connections...
[CRITICAL] BEACON_HTTPS_001
Destination: 185.220.101.1
Type: https
Connections: 16
Avg Interval: 60.0s
Jitter: 0.0s
Confidence: 90.0%
MITRE: T1071.001
Description: Possible C2 beacon detected to 185.220.101.1
[HIGH] BEACON_DNS_001
Destination: 23.129.64.100
Type: dns
Connections: 21
Avg Interval: 30.0s
Jitter: 0.0s
Confidence: 80.0%
MITRE: T1071.004
Description: Possible C2 beacon detected to 23.129.64.100
═══════════════════════════════════════════
Summary:
Connections Analyzed: 42
Beacons Detected: 2
Critical/High: 2
┌─────────────────────────────────────────────────────────────┐
│ Connection Parser │
│ PCAP | Live Capture | Zeek Logs │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Group by Destination IP │
│ Enum.group_by(& &1.dst_ip) │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Interval Analysis │
│ calculate_intervals | calculate_jitter | confidence │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Alert Generation │
│ BeaconPattern → Alert with severity and MITRE │
└─────────────────────────────────────────────────────────────┘
- Pattern Matching - Function head matching for different cases
- Pipe Operator -
|>for data transformation chains - Comprehensions -
forexpressions for list generation - Structs -
%Connection{},%BeaconPattern{},%Alert{} - Modules - Namespaced with
defmodule - Guards -
when length(timestamps) < 2 - Enum Functions -
group_by,map,filter,sort_by - Anonymous Functions -
& &1.dst_ipcapture syntax
defmodule BeaconPattern do
defstruct [
:dst_ip,
:intervals,
:avg_interval,
:jitter,
:connection_count,
:bytes_pattern,
:beacon_type,
:confidence
]
end
defmodule Alert do
defstruct [
:severity,
:beacon_pattern,
:rule_name,
:description,
:mitre,
:iocs
]
end| Factor | Weight | Condition |
|---|---|---|
| Regular Intervals | +30% | >3 intervals, jitter < 5s |
| Many Connections | +20% | >10 connections |
| Known Malicious IP | +40% | In threat intel list |
| Low Relative Jitter | +20% | jitter/avg < 10% |
- Threat Hunting - Proactively search for C2
- Incident Response - Identify active beacons
- Network Forensics - Analyze historical traffic
- SOC Operations - Real-time beacon detection
- Malware Analysis - Understand C2 behavior
This tool is intended for:
- ✅ Authorized network monitoring
- ✅ Security operations
- ✅ Incident response
- ✅ Research and education
Only analyze network traffic you're authorized to inspect.
- Portal: bad-antics.github.io
- Twitter: x.com/AnonAntics
- GitHub: github.com/bad-antics
MIT License - See LICENSE file for details.
- v1.0.0 - Initial release with beacon detection and jitter analysis
Part of the NullSec Security Toolkit
