6.2 Network-Level and Behavioral Anomaly Detection Use Cases

Command and Control (C2) Beaconing Detection

Adversaries establish Command and Control (C2) infrastructure to issue commands, maintain persistence, and coordinate data exfiltration from compromised enterprise hosts. To evade perimeter detection, advanced C2 frameworks (e.g., Cobalt Strike, Mythic, Sliver, Metasploit) communicate over standard enterprise protocols—such as HTTP, HTTPS (port 443), and DNS (port 53). Rather than keeping persistent TCP streams continuously open, the malware issues periodic check-ins or beacons to external command servers.

Statistical Properties of C2 Beaconing

To differentiate automated machine-to-machine beaconing from human-driven web browsing, SOC analysts and SIEM correlation engines analyze four primary traffic attributes:

1. Periodic Connection Intervals (Delta Time):
   • Automated agents execute a sleep loop (e.g., polling every 60 seconds). In proxy logs, firewall session tables, or Zeek conn.log streams, the time difference between consecutive connections (Delta t = t[i] - t[i-1]) displays a tight clustering around fixed intervals.
2. Jitter Analysis:
   • To disguise strict periodicity, modern frameworks introduce randomized jitter (e.g., 20% jitter on a 60-second sleep interval causes connections to occur randomly between 48 and 72 seconds).
   • Mathematical Detection: The SIEM computes the Coefficient of Variation (CV) of inter-arrival times: CV = Standard Deviation / Mean Interval. Human browsing exhibits a high CV (> 1.0), characterized by sporadic bursts and long pauses. In contrast, automated C2 beacons—even with 20% to 50% jitter—exhibit a remarkably low CV (< 0.30).
3. Payload and Byte Size Uniformity:
   • Routine beacon check-ins carry minimal payload data when no commands are queued. As a result, the number of bytes transmitted (bytes_out) and bytes received (bytes_in) remains nearly identical across hundreds of successive connections (e.g., exactly 342 bytes out, 218 bytes in).
4. Persistent High-Frequency Outbound Requests:
   • Connections persist around the clock (24/7), occurring during non-business hours when legitimate user activity drops to zero.

[Sample Zeek conn.log Beaconing Analysis]
#ts          uid       orig_h         resp_h          resp_p proto orig_bytes resp_bytes
1718000000.1 C1a8Bx  10.10.4.15     198.51.100.42   443    tcp   342        218
1718000060.2 C2b9Cy  10.10.4.15     198.51.100.42   443    tcp   342        218
1718000120.1 C3c0Dz  10.10.4.15     198.51.100.42   443    tcp   342        218
1718000180.3 C4d1Ea  10.10.4.15     198.51.100.42   443    tcp   342        218
--> Delta t ≈ 60.1s | StDev ≈ 0.08 | Uniform Bytes: 342 Out / 218 In --> High-Confidence Beacon

---

Data Exfiltration Detection Mechanisms

Data exfiltration represents the penultimate phase of many cyber intrusions, where adversaries transfer proprietary data, intellectual property, or credentials outside the enterprise boundary.

Massive Outbound Data Transfers

• Detection Baseline: SOCs monitor egress volume per host against historical 30-day baselines. Threshold alerts trigger when an internal endpoint transfers outbound data exceeding a statistical upper limit (Mean + 3 * Standard Deviation) or a fixed threshold (e.g., > 5 GB to an external IP in < 1 hour).
• Cloud Storage Exfiltration: Threat actors bypass perimeter egress controls by uploading compressed archives to legitimate, unapproved cloud services (Dropbox, Mega.nz, Google Drive, Box). Network proxies detect this via HTTP POST and PUT methods with large Content-Length headers directed at cloud storage categories.

DNS Tunneling Detection

DNS tunneling exploits recursive DNS resolution to encapsulate non-DNS payloads within domain query labels. Because organizations permit internal endpoints to query internal DNS resolvers (which forward recursive lookups to the Internet), adversaries use DNS as a covert, bidirectional data transfer channel.

[Sample DNS Tunneling Queries]
g4Zt1aBq9kLm.exfil.malicious-domain.com  IN TXT (Bytes 1-20)
y7Rq4wPx2nTb.exfil.malicious-domain.com  IN TXT (Bytes 21-40)
m8Lp3vNz1kXq.exfil.malicious-domain.com  IN TXT (Bytes 41-60)

DNS Tunneling vs. Normal DNS Metric Breakdown

ICMP Tunneling

Standard ICMP Echo Request (ping, Type 8) packets contain small static data payloads (e.g., 32 bytes on Windows containing the alphabet abcdefghijklmnopqrstuvwabcdefghi, or 64 bytes on Linux). Tools like ptunnel or icmpsh embed arbitrary TCP streams, shell commands, or files inside the ICMP payload field.

• Detection Signature: High-frequency ICMP traffic (> 10 packets/sec) or ICMP Echo Request/Reply packets where payload size exceeds standard limits (e.g., icmp_payload_size > 128 bytes), or payload exhibits high Shannon entropy.

---

Lateral Movement Detection

Once an initial endpoint is compromised, attackers traverse the internal network to compromise additional hosts, locate critical data stores, and escalate privileges toward Domain Admin.

SMB and RPC Abuse

Adversaries exploit Server Message Block (SMB, TCP port 445) and Remote Procedure Call (RPC, TCP port 135) to execute remote commands and access administrative shares (C$, ADMIN$, IPC$):

• PsExec Activity:
  • PsExec copies a service executable into the ADMIN$ share and instructs the remote Service Control Manager to start it.
  • Telemetry: System Event ID 7045 on the destination host logging service installation for PSEXESVC (%SystemRoot%\PSEXESVC.exe).
  • Network: Security Event ID 5145 (Shared object checked) accessing ADMIN$ and connecting to named pipe \pipe\psexec*.
• WMI Remote Execution:
  • Adversaries execute remote processes via Windows Management Instrumentation: wmic /node:"10.10.4.50" process call create "powershell.exe -enc ...".
  • Telemetry: Windows WMI Activity Operational log Event ID 5861 on the remote host, alongside Security Event ID 4688 where the parent process is WmiPrvSE.exe.
• Suspicious RDP Connections and Session Hijacking:
  • Workstation-to-workstation RDP connections (e.g., Finance workstation to HR workstation) are highly anomalous in secure enterprises where administrative access must pass through a privileged Jump Box.
  • Telemetry: Microsoft-Windows-TerminalServices-LocalSessionManager Event ID 21 (Session logon succeeded), Event ID 24 (Session disconnected), and Event ID 25 (Session reconnection).

---

User and Entity Behavior Analytics (UEBA)

Traditional SIEM correlation rules rely on static signatures and static thresholds (e.g., alert if >5 failed logins occur in 5 minutes). While effective for noisy attacks, static rules fail against stealthy, low-and-slow adversary behavior or compromised insider credentials. User and Entity Behavior Analytics (UEBA) utilizes statistical modeling and machine learning algorithms to build dynamic baselines of normal activity for every user, account, and device on the network.

Dynamic Baselining and Peer Group Analysis

• Dynamic Baselining: UEBA models a 30- to 90-day baseline of user activity: typical login times, usual source IP subnets, average daily file access volume, normal applications executed, and standard cloud services visited. An alert fires when an observed metric deviates significantly from that user's historical profile.
• Peer Group Analysis: Users are grouped by organizational attributes (e.g., Active Directory Organizational Unit OU=Finance, job title, manager). If a financial analyst suddenly runs net.exe group "Domain Admins" /domain or initiates an SSH session to a Linux production database, the UEBA system compares this against the peer group baseline. Because no other finance user performs this activity, the anomaly score spikes dramatically.

Anomalous Login Locations: Impossible Travel Walkthrough

An Impossible Travel (or velocity anomaly) alert triggers when a single user account logs in from two distinct geographical locations within a time window that is physically impossible to traverse via commercial air travel.

[Impossible Travel Calculation Example]
Formula: Velocity = (Great-Circle Distance between Location 1 and Location 2) / (Elapsed Time)

Event 1: User 'alice@corp.com' authenticates via Azure AD SSO
         - Timestamp: 14:00:00 UTC
         - Location: New York City, USA (IP: 198.51.100.24)

Event 2: User 'alice@corp.com' authenticates via Office 365
         - Timestamp: 14:45:00 UTC
         - Location: London, United Kingdom (IP: 203.0.113.88)

Calculations:
1. Distance: New York City to London = 5,570 km (3,460 miles)
2. Elapsed Time: 45 minutes = 0.75 hours
3. Calculated Speed: 5,570 km / 0.75 hours = 7,426.7 km/h (4,614 mph)
4. Threshold: Maximum commercial airliner speed ≈ 900 km/h (560 mph)

Assessment: Velocity (7,426.7 km/h) exceeds physical threshold by >8x.
Alert Status: CRITICAL - High-Fidelity Credential Compromise / Account Takeover.
Triage Exception Check: Verify whether London IP is a corporate VPN egress gateway or cloud proxy.

Dormant Account Sudden Activity

Service accounts or former employee accounts that have recorded zero authentications for 60 to 90 days represent prime targets for adversaries. UEBA flags any authentication attempt (Security Event ID 4624) or privilege usage originating from a designated dormant account for immediate tier 1 containment.

---

Comparison Table of Network Anomaly Scenarios