As cited
Copy frozen at (site build).
threat intel
Identifying beaconing malware using Elastic
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Identifying beaconing malware using Elastic
Elastic has published a beaconing identification framework that detects command-and-control (C2) communication patterns in network traffic using statistical and signal processing techniques applied to the Elastic Stack. The framework uses coefficient of variation, relative variance, and autocorrelation analysis to identify malware beacons while accounting for obfuscation techniques like jitter and variable intervals. Testing on known malware including NOBELIUM, Koadic, and Emotet demonstrated the framework's ability to detect malicious processes and associated indicators of compromise (IOCs) while reducing the volume of network data analysts must review.
Why it matters: Security teams using Elasticsearch can deploy this framework to detect advanced malware that uses C2 beaconing for command execution and data exfiltration, potentially identifying threats within hours or days of initial compromise before attackers achieve their objectives.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Identifying beaconing malware using Elastic
Elastic has published a beaconing identification framework that detects command-and-control (C2) communication patterns in network traffic using statistical and signal processing techniques applied to the Elastic Stack. The framework uses coefficient of variation, relative variance, and autocorrelation analysis to identify malware beacons while accounting for obfuscation techniques like jitter and variable intervals. Testing on known malware including NOBELIUM, Koadic, and Emotet demonstrated the framework's ability to detect malicious processes and associated indicators of compromise (IOCs) while reducing the volume of network data analysts must review.
Why it matters: Security teams using Elasticsearch can deploy this framework to detect advanced malware that uses C2 beaconing for command execution and data exfiltration, potentially identifying threats within hours or days of initial compromise before attackers achieve their objectives.
- Source published
- First seen by Cybersecurity Tracker