title: C2 Beaconing Activity
id: 8e769ed8-4f63-516c-b5e1-69a8b05f3c5d
custom_id: wf-net-002
status: stable
level: high
description: |
    Detects potential command-and-control beaconing by identifying connections
    to external servers classified as botnet or C2 activity by WitFoo lead rules.
    Regular-interval check-ins are a hallmark of malware C2 communication.
author: WitFoo
date: 2026-02-21
tags:
    - attack.command_and_control
    - attack.t1071.001
references:
    - https://attack.mitre.org/techniques/T1071/001/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "botnet_connection"
    condition: selection
fields:
    - clientIP
    - serverIP
    - serverPort
    - protocol
    - streamName
    - matchedLeadRules
falsepositives:
    - Legitimate monitoring agents with periodic polling
    - Software update check-in services