## Use Case 2: Malware Beaconing (Easy)

**Scenario**: A user clicks a malicious link. Malware installs on their laptop. The malware needs instructions, so it "phones home" to the attacker's Command & Control (C2) server. This checking-in process is called **Beaconing**.

### The Logic
Beaconing is automated. Computers form patterns (heartbeats); humans do not.

### 1. The Data Sources
*   **Source**: Firewall Logs, Proxy Logs, or DNS Logs.
*   **Key Fields**:
    *   `src_ip`: The infected laptop.
    *   `dest_ip` or `dest_domain`: The C2 server.
    *   `bytes_sent/received`: Usually small (just asking "Any commands for me?").
    *   `frequency/interval`: The time between connections.

### 2. The Pattern (Signatures)
*   **Regularity**: Connection to the same IP every 60 seconds (or exactly 5 minutes, etc.).
*   **Long Duration**: This connection happens 24/7, even when the user is asleep.
*   **Jitter**: Sophisticated malware adds "jitter" (random delay) to hide. E.g., 60s, then 65s, then 58s.

### 3. The SIEM Rule (Pseudocode)
Detection often requires statistical analysis, not just simple matching.
```sql
Alert IF:
    Same Source_IP connecting to Same Dest_IP
    Count > 50 times in 24 hours
    AND
    Standard_Deviation(Time_Between_Connections) is Low (< 5 seconds)
```

### 4. Investigation Steps (The Playbook)
1.  **Analyze the Destination**:
    *   Is the domain `google.com` (benign) or `x83js92.ru` (suspicious)?
    *   Is the destination IP hosting a known valid service (Microsoft Update) or a cheap VPS?
    *   Use **Whois** to check domain age. (Newly registered domains < 30 days old are high risk).
2.  **Analyze the Payload**:
    *   Check Proxy logs. User-Agent string?
    *   Is it `Mozilla` (Browser) or `Python-requests` (Script)?
3.  **Check Endpoint**:
    *   Identify the process making the connection.
    *   Is `chrome.exe` connecting? Or is it `powershell.exe` connecting to the internet? (PowerShell connecting to a Russian IP is almost certainly bad).

### 5. False Positives
*   Legitimate software updates (Adobe Updater checks in every hour).
*   NTP (Time sync) traffic.
*   Telemetry from legitimate apps (Spotify "I'm still playing" signals).

### 6. Mitigation
*   **Block**: Add the C2 IP/Domain to the Firewall blocklist.
*   **Isolate**: Take the infected machine off the network.
*   **Reimage**: Malware often has persistence mechanisms that are hard to remove partially; wiping the machine is safest.