Red › Module 5 › Lesson 2
Beacon Concepts
Beacon behavior — callback interval, tasking, sleep — literacy for blue detection on $LAB_RT, not operational stranger C2.
Visual · rt_beacon_concepts
Beacon concepts literacy. $LAB_RT only. Original Cyberlium.
Opening
Beacons are scheduled check-ins — defenders hunt jitter, URI patterns, and anomalous egress.
Agents/beacons call home to C2 servers on intervals (sleep/jitter), receive tasks, return output. Network indicators include periodic HTTPS to rare domains, unusual User-Agents, and long-lived connections. Process indicators include injected threads, parent spoofing, and LOLBin launch chains mapped to ATT&CK Execution and C2 tactics. Cyberlium teaches beacon concepts for detection mapping on $LAB_RT lab traffic — not tuning beacons for evasion against real SOCs on unauthorized networks. Next: Lab C2 Only.
1. Sleep, jitter, and tasking vocabulary
Sleep: seconds between callbacks. Jitter: random variance to avoid fixed intervals. Tasking: operator jobs (shell, upload, pivot) queued to agent. Blue detects regular low-volume beaconing and task spikes on $LAB_RT SIEM fixtures.
Document expected beacon profile in plan pack so purple debrief compares expected vs observed alerts.
Command guide
Try these commands — Sleep, jitter, and tasking vocabulary
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Beacon concepts — https://attack.mitre.org/techniques/T1071/ (application layer C2 literacy) Mythic docs — https://docs.mythic-c2.net/ (purple-team framework literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
ss -tulpn 2>/dev/null | grep -E 'LISTEN|State' | head -12 journalctl --no-pager -n 20 2>/dev/null | grep -iE 'connect|network|sshd' | head -8 || journalctl --no-pager -n 10 2>/dev/null | tail -5
Primary tools to practice this lesson: ss, journalctl. Reference sites: Beacon concepts (https://attack.mitre.org/techniques/T1071/); Mythic docs (https://docs.mythic-c2.net/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Network and host artifacts blue hunts
Network: DNS beaconing, HTTPS to young domains, JA3/JA4 TLS fingerprints, proxy logs. Host: Sysmon process create, WFP connections, unusual persistence coupling to beacon parent.
On $LAB_RT, generate sample beacon traffic in isolated segment — correlate with detection rules — never against production egress.
3. Beacon literacy supports detection — not evasion crime
Forbidden: evasion tuning against employer SOC without engagement, long-duration beacons on classmates, exfil over stranger C2. Allowed: describe beacon concepts and map to detections for $LAB_RT exercise.
Ship: beacon concept glossary + three detection ideas for $LAB_RT. Next: Lab C2 Only.
4. What you ship: beacon concept glossary for $LAB_RT
Sleep/jitter/tasking defined. Three detection ideas. $LAB_RT lab traffic only. chmod 600.
5. What you record before the next lesson
Date. Beacon glossary. $LAB_RT named. File t21-m05-l02-beacon-concepts.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tune beacon evasion on production. Run month-long beacon on classmate VM.
Right
Write beacon glossary with detection mapping for $LAB_RT. Next: Lab C2 Only.
Mission: document beacon concepts for blue
1) Define sleep, jitter, tasking. 2) List three detection ideas. 3) Note $LAB_RT isolated traffic only. 4) chmod 600. Never operationalize beacons outside RoE.
Stuck? Ask Cyberlium AI Mentor
Purple teams compare expected beacon profile to SIEM — document both.
Knowledge Check
APPLY: Beacon concepts on Cyberlium support:
Multiple choice
Knowledge Check
APPLY: True or False: Jitter randomizes callback timing.
True or False
Knowledge Check
APPLY: Beacon network indicators blue hunts include:
Multiple choice