TechKnowSurge

VideoSecurityFree

Beaconing

Beaconing is a command-and-control technique in which malware on a compromised system periodically sends outbound check-in requests to an attacker's server, bypassing firewall restrictions that block inbound connections.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Beaconing is a network behavior associated with command-and-control infrastructure, in which malware on a compromised system repeatedly contacts an attacker-controlled server at predictable intervals to check for instructions. The technique is commonly deployed after an initial compromise—delivered through methods such as phishing emails or removable media—that installs malicious software without giving the attacker direct, real-time access to the target machine. Rather than waiting for an inbound connection that a firewall would block, the malware initiates outbound requests, which most network defenses permit by default, effectively circumventing perimeter security controls. The defining characteristic of beaconing is its regularity. The compromised host sends check-in requests on a fixed or slightly randomized schedule—potentially ranging from once per second to once every several days—creating a detectable pattern in network traffic logs. Security analysts and threat hunters monitor for this type of anomalous, repetitive outbound communication as a strong indicator of compromise, making beaconing detection a foundational skill in network traffic analysis and incident response.

What you'll learn

Explain how beaconing functions as a command-and-control indicator of compromise, including how malware initiates outbound check-ins to bypass firewall restrictions

What's covered

Beaconing

What Is Beaconing
- Outbound strange traffic
- Command and control indicator
How It Works
- Malware installed on host
  - Via removable device
  - Via email
- Firewall blocks inbound
- Host checks out regularly
Beacon Intervals
- Seconds to minutes
- Hours to days
Command and Control Role
- Adversary controls remotely
- Botnet relationship

Key terms

Beaconing: A pattern of regular, repeated outbound network communications from a compromised host to an attacker's command-and-control server.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Botnet: A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Egress Filtering: The practice of monitoring and restricting outbound network traffic based on security policies.

Topics

Beaconing Command And Control Malware Analysis Indicators Of Compromise Network Security Firewall Evasion Cybersecurity

Transcript

Beaconing

One of the indicators that we are looking for is something called beaconing. Essentially, beaconing is that strange traffic that is going outside of our network. But it's a specific type of strange traffic, so let's take a look at what that is.

Beaconing is associated with command and control, where you have some sort of controlling software and maybe some sort of botnet on here. This laptop in this case right here -- it could be a server, it could be something else -- is controlling this computer.

But the thing is, maybe this adversary tricked somebody into installing malware on this computer. Maybe that was through a removable device, or through email, or whatever the case may be. The malware got installed on here, but this adversary doesn't actually have access to control that computer directly. It can't make it past the firewall -- it gets denied right there. That's what the firewall's job is to do.

But traffic usually can go out from the inside to the outside just fine. So what happens is that this computer reaches out and says, "Hey, do you have anything for me to do?" And it does that on some sort of interval. Maybe it's a second, maybe it's a minute, maybe it's every 10 minutes, maybe it's every day, maybe it's every 10 days. Whatever the interval is, it's going to check and say, "Hey, do you have anything for me to do? Hey, do you have anything for me to do? Hey, do you have anything for me to do?" And check in. So we call that beaconing.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →