C2 detection: find the channel, not yesterday's signature.

What command-and-control actually looks like now

The stereotype is a strange port talking to a strange country. Real operators stopped doing that years ago. What you get instead is traffic that is boring on purpose:

• Ordinary ports and ordinary protocols. Usually 443, usually TLS, because blocking that is not an option for you.
• Real, reputable destinations. Major cloud and CDN domains used as intermediaries, so a reputation lookup returns clean.
• Long intervals with jitter. A check-in every few hours rather than every few seconds, tuned to sit below any threshold based on volume.
• Tiny payloads. Just enough to ask for orders, so no byte-count alarm fires.
• Channels nobody inspects. Control smuggled inside DNS queries or ICMP payloads, which very often walk straight past a web proxy.

How we detect it

The premise is that you cannot enumerate the destinations, so you have to characterise the conversation. A blocklist is a useful extra input, never the primary one.

• Beacon rhythm. A machine talking to the same destination on a regular cadence, with the statistical regularity of a scheduled process rather than the irregularity of a person browsing.
• Low-and-slow channels. Explicitly modelled, because the whole point of a long interval is to defeat detectors that only look at volume.
• Encoded data in DNS. Measured with thresholds that account for the alphabet in use. A fixed entropy floor silently misses hex-encoded tunnels, because entropy is bounded by the character set, and we learned that the hard way rather than in theory.
• Covert ICMP. Payload-carrying echo traffic, which is a control channel with no legitimate business purpose in most networks.
• Protocol and port disagreement. A protocol appearing on a port that is not its own, which is a deliberate evasion far more often than an accident.
• Client fingerprinting. Identifying the software making a TLS connection, so a scripted client pretending to be a browser stands out from a browser.
• Relay and tunnel shapes. Traffic that arrives at one host and leaves it for elsewhere, which is how a foothold becomes a route.

The limits, up front

We do not decrypt TLS. The detections above are about timing, size, rhythm, destination and fingerprint, not about reading contents. That is a deliberate design choice and it is also why deployment does not require you to hand us keys or break inspection.

It also means a single-shot transfer with no ongoing channel is a different problem, handled by exfiltration detection rather than beacon detection. We would rather draw that line clearly than imply one detector covers everything.