M ManySignal

Use Case: Endpoint

Command and control detection

A signed Windows binary is beaconing to a 3-day-old domain every 47 seconds with 15-second jitter. That's Cobalt Strike. ManySignal identified it in the first beacon cycle.

Book a demo Endpoint attack surface
Attack scenario

The beacon hiding in normal HTTPS traffic

Modern C2 frameworks — Cobalt Strike, Sliver, Brute Ratel C4, Havoc — are designed specifically to blend into normal corporate internet traffic. They use legitimate TLS certificates, mimic browser user agents, and configure beacon intervals that match normal human browsing behavior. Some use domain fronting via AWS CloudFront or Cloudflare to hide the actual C2 server behind a trusted CDN IP range.

The detection requires combining three perspectives: network timing analysis (beacon regularity is statistically distinguishable from human browsing), process context (cmd.exe or an Office document process making outbound HTTPS is abnormal), and threat intelligence (the destination domain or certificate has known malicious associations).

Detection logic 
rule: c2_beacon_detection
type: behavioral + threat_intel
sources:
  - netflow / zeek_conn
  - dns_query_log
  - crowdstrike / sentinelone network events
  - tls_metadata (jarm fingerprint, cert details)
trigger:
  - OR:
    - condition: |
        connection_regularity_score(host, dest) > 0.85
        AND connection_count > 10 WITHIN 15m
    - condition: threat_intel_match(dest_ip OR dest_domain)
    - condition: |
        initiating_process NOT IN browser_whitelist
        AND dest_domain.age_days < 30
        AND dest_cert.issuer IN ["Let's Encrypt", "ZeroSSL"]
enrichments:
  - jarm_fingerprint: known_c2_jarm_db
  - domain_intel: dnstwist, threatfox, vt
  - process_tree: edr_parent_chain
mitre: T1071.001 (Web Protocols), T1568 (Dynamic Resolution)
Triage agent questions
1

What is the beacon interval and jitter pattern of the outbound connections?

NetFlow timing analysis
2

Does the destination domain appear in threat intelligence as known C2 infrastructure?

Recorded Future / ThreatFox
3

Is the destination a DGA-generated domain (high entropy, recently registered)?

DNS analysis
4

What process initiated the connection — is it a browser, a signed executable, or an injected process?

EDR process tree
5

Has this host shown any other post-exploitation indicators in the past 24 hours?

EDR correlation
6

Is traffic using domain fronting via a CDN (Cloudflare, AWS CloudFront)?

TLS SNI analysis
Response playbook
1

Block the C2 destination at the DNS and proxy layer

Autonomous
2

Isolate the beaconing host from the network pending investigation

Approve-gated
3

Kill the process responsible for the outbound connection

Approve-gated
4

Extract network IOCs and add to threat intel feed for tenant-wide blocking

Autonomous
5

Initiate full compromise assessment of the host

Recommend

MITRE ATT&CK mapping

T1071.001 — Web ProtocolsT1568 — Dynamic ResolutionT1090.004 — Domain FrontingT1095 — Non-Application Layer Protocol

C2 detection FAQ

How does ManySignal detect C2 over HTTPS without decrypting traffic?

ManySignal analyzes TLS metadata: SNI hostname, certificate issuer, session duration, connection frequency, and byte volume asymmetry (C2 beacons have a distinctive pattern of small outbound and larger inbound bursts). Process-level context from the EDR identifies which process initiated the TLS connection without requiring full decryption.

What about C2 via Slack, Discord, or other legitimate platforms?

C2 over legitimate platforms is detected by the process making the connection (not a browser, not a known Slack client) combined with unusual API call patterns. Cobalt Strike's Slack C2 profile and similar tools have been documented and their behavioral fingerprints are in ManySignal's detection library.

Does this cover DNS-over-HTTPS (DoH) C2 evasion?

DoH C2 is detected at the process level — the process making DoH requests to 8.8.8.8 or 1.1.1.1 that isn't a browser or system resolver is anomalous. EDR-level DNS query logging captures the resolved domains regardless of whether standard or encrypted DNS was used.

How current is the C2 threat intelligence?

ManySignal integrates with ThreatFox, Recorded Future, VirusTotal, Shodan, and MandiantAdvantage for C2 infrastructure intelligence. Updates are ingested in near-real-time. In-house threat research adds new C2 framework signatures (Sliver, Brute Ratel, Havoc) within hours of public disclosure.

Identify active C2 channels in your environment

NetFlow timing analysis, TLS fingerprinting, and threat intel — correlated automatically. See beacons in the first demo.

Book a demo Explore the platform