Netskope - Multi-Protocol C2 Beaconing Pattern

79 NK Multi Protocol C2beaconing

Query

let _NetskopeEmpty = datatable(TimeGenerated:datetime, action_s:string, category_s:string, severity_s:string, malware_name_s:string, malware_type_s:string, threat_name_s:string, user_s:string, domain_s:string, dstip_s:string, srcip_s:string, bytes_uploaded_d:real, bytes_downloaded_d:real, app_s:string, url_s:string, dlp_rule_s:string, dlp_profile_s:string, activity_s:string, file_type_s:string, object_s:string, dst_country_s:string, src_country_s:string, ccl_s:string, access_method_s:string, traffic_type_s:string)[];
let SuspiciousCategories = dynamic([
    "Uncategorized", "Unknown", "Newly Observed Domain",
    "Newly Registered Domain", "Suspicious", "Parked",
    "Dynamic DNS Host", "Malware", "Command and Control"]);
let RiskyCCL = dynamic(["poor", "low", "unknown"]);
union isfuzzy=true _NetskopeEmpty, NetskopeWebTx_CL
| where TimeGenerated > ago(1d)
| where isnotempty(user_s) and isnotempty(domain_s)
| where category_s in (SuspiciousCategories) or ccl_s in (RiskyCCL)
| summarize
    RequestCount     = count(),
    RequestTimes     = make_list(TimeGenerated, 200),
    TotalBytesSent   = sum(todouble(bytes_uploaded_d)),
    TotalBytesRecv   = sum(todouble(bytes_downloaded_d)),
    SourceIPs        = make_set(srcip_s, 5),
    Categories       = make_set(category_s, 5),
    CCL              = take_any(ccl_s),
    DstIPs           = make_set(dstip_s, 5),
    DstCountries     = make_set(dst_country_s, 5),
    FirstSeen        = min(TimeGenerated),
    LastSeen         = max(TimeGenerated)
  by user_s, domain_s
| where RequestCount >= 20
| extend
    DurationMinutes  = datetime_diff('minute', LastSeen, FirstSeen),
    AvgIntervalSec   = iff(RequestCount > 1,
                           round(toreal(datetime_diff('second', LastSeen, FirstSeen)) / (RequestCount - 1), 1),
                           0.0)
| where DurationMinutes >= 60
| where AvgIntervalSec between (10.0 .. 600.0)
| project
    user_s, domain_s, RequestCount,
    AvgIntervalSec, DurationMinutes,
    TotalBytesSent, TotalBytesRecv,
    Categories, CCL, DstIPs, DstCountries, SourceIPs,
    FirstSeen, LastSeen
| order by RequestCount desc, AvgIntervalSec asc

Explanation

This query is designed to detect suspicious network activity that may indicate a Command and Control (C2) beaconing pattern. Here's a simple breakdown of what it does:

Purpose: It identifies users who are making frequent, evenly-timed requests to domains that are either suspicious or have a low reputation. This can be a sign of malware communicating with a C2 server.
Data Source: The query uses data from the NetskopeWebTx_CL table, which is ingested via Blob Storage.
Detection Criteria:
- It looks for requests made in the last 24 hours.
- It filters for domains categorized as suspicious or with a low Confidence Classification Level (CCL).
- It counts the number of requests per user and domain, requiring at least 20 requests to consider it significant.
- It calculates the average interval between requests, focusing on intervals between 10 and 600 seconds.
- It ensures the activity spans at least 60 minutes.
Output: The query outputs details such as the user, domain, request count, average interval, total bytes sent and received, and other relevant information.
Alerting: If the criteria are met, an alert is generated with details about the user and domain involved, including the average interval of requests.
Incident Management: The query is configured to create incidents for detected patterns, with options for grouping related alerts by user account and domain.
Severity and Techniques: The severity of the alert is high, and it maps to MITRE ATT&CK techniques T1071 (Application Layer Protocol) and T1573 (Encrypted Channel), indicating potential use of application layer protocols and encrypted channels for C2 communication.

In summary, this query helps identify potential C2 communication by detecting regular, suspicious network activity patterns, which can be crucial for early detection of cyber threats.

Details

David Alonso

Released: May 14, 2026

Tables

NetskopeWebTx_CL

Keywords

NetskopeWebTransactionsUserDomainSourceIPDestinationCategoriesCCLRequestCountTotalBytesSentReceivedFirstSeenLastAccountDNS

Operators

letdatatabledynamicunionisfuzzyagoisnotemptyinsummarizecountmake_listsumtodoublemake_settake_anyminmaxbyextenddatetime_diffiffroundtorealbetweenprojectorder by

Severity

High

Tactics

CommandAndControl

MITRE Techniques

T1071 T1573

Frequency: PT1H

Period: P1D

Actions

GitHub

KQL Search