Detect Application Layer Protocol in CrowdStrike LogScale
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1071 Application Layer Protocol
- Canonical reference
- https://attack.mitre.org/techniques/T1071/
LogScale Detection Query
#event_simpleName=NetworkConnectIP4
| RemotePort in [80, 443, 53, 21, 25, 110, 143, 8080, 8443, 1883, 5222]
| !cidr(field=RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([ComputerName, ImageFileName, ContextProcessId], function=[
count(as=ConnectionCount),
min(field=@timestamp, as=FirstSeen),
max(field=@timestamp, as=LastSeen),
collect(field=RemotePort, as=Ports, limit=20),
count(field=RemoteAddressIP4, distinct=true, as=UniqueRemoteIPs)
])
| ConnectionCount > 10
| eval Duration := LastSeen - FirstSeen
| eval AvgIntervalMs := if(ConnectionCount > 1, Duration / (ConnectionCount - 1), 0)
| AvgIntervalMs > 1000 AND AvgIntervalMs < 3600000
| eval BeaconScore := if(
(AvgIntervalMs >= 55000 AND AvgIntervalMs <= 65000) OR
(AvgIntervalMs >= 295000 AND AvgIntervalMs <= 305000) OR
(AvgIntervalMs >= 895000 AND AvgIntervalMs <= 905000),
"high",
"medium")
| sort(field=ConnectionCount, order=desc)Detects C2 beaconing over application layer protocols using CrowdStrike Falcon sensor NetworkConnectIP4 telemetry in LogScale. Groups outbound connections to external IPs by host, executable image path, and process ID. Computes average inter-connection interval from LogScale's millisecond-precision @timestamp field. Flags processes with more than 10 external connections on common protocol ports with intervals between 1 second and 1 hour. Beacon score is HIGH for intervals matching 60s, 300s, or 900s C2 sleep patterns common in Cobalt Strike, Metasploit, and commodity RATs.
Data Sources
Required Tables
False Positives & Tuning
- The CrowdStrike Falcon sensor process itself (CSFalconService, falcond) and other EDR agents make regular check-ins to cloud infrastructure — whitelist known EDR process image paths in ImageFileName
- Software configuration management tools (Puppet agent, Chef client, Ansible pull mode) that poll controller nodes at configured run intervals over 443 or 8443 match both the connection count and scored interval thresholds
- Unified communications clients (Microsoft Teams, Zoom, Cisco Webex) maintaining persistent WebSocket or HTTPS keep-alive connections to CDN endpoints at near-regular heartbeat intervals, particularly on port 443 or 8443
Other platforms for T1071
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Multi-Protocol Beaconing Simulation
Expected signal: Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.
- Test 2 IRC C2 Channel Simulation
Expected signal: Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.
- Test 3 HTTP Beaconing with Cobalt Strike User-Agent
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.
Response Playbook
Triage
- Identify the process initiating the connections — is it a known system binary, legitimate application, or suspicious/unknown executable?
- Examine the connection pattern — are connections regular (fixed intervals) or jittered? C2 frameworks often add jitter to avoid detection
- Check the remote IP reputation using threat intelligence feeds (VirusTotal, AbuseIPDB, OTX) and geolocation data
- Review the protocol and port combination — is the traffic on expected ports for that protocol? Look for protocol misuse (e.g., HTTP tunneling over port 53)
- Check if the process has a valid digital signature and whether its parent process chain is legitimate
- Correlate with DNS logs to identify the domain associated with the remote IP
Containment
- If confirmed C2: immediately isolate the endpoint using EDR network isolation or VLAN quarantine
- Block the identified C2 IP addresses and domains at the firewall and DNS level
- If lateral movement is suspected: isolate all potentially compromised hosts and reset affected credentials
- Disable any compromised service accounts and revoke OAuth/API tokens
- Create temporary firewall rules to block the specific port/protocol combination used by the C2 channel
Evidence Collection
- Full PCAP of the suspicious network connections for protocol-level analysis
- Process memory dump of the initiating process for malware analysis
- Sysmon Event ID 3 (Network Connection) logs with full process context
- DNS query logs correlated with connection timestamps
- Proxy/firewall logs showing full URL paths and HTTP headers if applicable
- Endpoint process tree showing parent-child relationships of the suspicious process
Escalation Criteria
- !Beaconing pattern matches known C2 framework signatures (e.g., 60s Cobalt Strike default sleep)
- !Multiple endpoints beaconing to the same external IP or domain
- !Process associated with the connections is unsigned, recently dropped, or has been tampered with
- !Evidence of data exfiltration (large outbound data volumes during beacon windows)
- !The connection uses non-standard protocol/port combinations (e.g., DNS traffic not to port 53, or HTTP to high ports)
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Network flow records (NetFlow/IPFIX) showing connection metadata - >
Sysmon Event ID 3 — Network connection events with process context - >
Windows Security Event ID 5156 — Windows Filtering Platform (WFP) permitted connections - >
Proxy logs with full URL, User-Agent, and response codes - >
DNS query logs showing domain resolution preceding network connections - >
Firewall logs with action, bytes transferred, and session duration
Tuning Guidance
Start by baselining legitimate application layer protocol usage across your environment. Identify known update services, monitoring agents, and IoT devices that communicate on regular intervals. Create allowlists based on (source process + destination IP/domain + port) tuples rather than broad port exclusions. Adjust the beacon interval thresholds based on your environment's noise floor — environments with many IoT devices may need higher thresholds. Consider deploying JA3/JA3S fingerprinting for TLS connections to identify known C2 framework handshakes even when traffic is encrypted.
Hunting Queries
Hunt for processes making high volumes of outbound connections across multiple ports and IPs. Multi-protocol C2 frameworks often use fallback channels, switching between HTTP, DNS, and other protocols when one is blocked.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize ConnectionCount=count(), UniqueIPs=dcount(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName
| where ConnectionCount > 50
| where array_length(Ports) > 2
| sort by ConnectionCount descindex=proxy OR index=firewall sourcetype IN ("stream:tcp", "pan:traffic") action=allowed NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
| stats count as ConnectionCount, dc(dest_ip) as UniqueIPs, values(dest_port) as Ports by src_ip, process_name
| where ConnectionCount > 50 AND mvcount(Ports) > 2
| sort - ConnectionCountHunt for connections to uncommon application layer protocol ports (MQTT 1883, XMPP 5222, AMQP 5672, STOMP 61613). These pub/sub and messaging protocols are increasingly abused for C2 due to low detection coverage in most environments.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where RemotePort in (1883, 5222, 5672, 61613)
| summarize ConnectionCount=count(), UniqueIPs=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemotePort
| sort by ConnectionCount descindex=network sourcetype IN ("stream:tcp", "pan:traffic") dest_port IN (1883, 5222, 5672, 61613) action=allowed NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
| stats count as ConnectionCount, dc(dest_ip) as UniqueIPs by src_ip, process_name, dest_port
| sort - ConnectionCountHunt for extremely consistent connection patterns — processes making a nearly identical number of connections per hour over multiple days. A very low standard deviation in hourly connection counts indicates automated, programmatic communication typical of C2 rather than human-driven activity.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize Connections=count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| summarize HourlyAvg=avg(Connections), HourlyStdDev=stdev(Connections), TotalHours=count() by DeviceName, InitiatingProcessFileName
| where HourlyStdDev < 2 and TotalHours > 24
| sort by TotalHours descindex=proxy OR index=firewall sourcetype IN ("stream:tcp", "pan:traffic") action=allowed NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
| bin _time span=1h
| stats count as Connections by src_ip, process_name, _time
| stats avg(Connections) as HourlyAvg, stdev(Connections) as HourlyStdDev, count as TotalHours by src_ip, process_name
| where HourlyStdDev < 2 AND TotalHours > 24
| sort - TotalHoursAtomic Red Team Tests
Simulates C2 beaconing across multiple application layer protocols by making periodic outbound connections to localhost on common C2 ports (HTTP 80, HTTPS 443, DNS 53). This mimics the multi-protocol fallback behavior of advanced C2 frameworks like Cobalt Strike and Sliver.
Command
for port in 80 443 53; do for i in $(seq 1 5); do curl -s -o /dev/null --connect-timeout 2 http://127.0.0.1:$port/ 2>/dev/null; sleep 2; done; doneExpected Telemetry
Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.
Expected Detection
Alert fires on repeated connections at regular intervals across multiple ports from the same source process. BeaconScore should trigger based on consistent 2-second intervals.
Simulates malware connecting to an IRC server for C2 communications, as used by Hildegard, Magic Hound, Siloscape, and TeamTNT. Uses netcat to attempt a connection to a non-existent IRC server on the standard port.
Command
echo -e 'NICK testbot\nUSER testbot 0 * :test\nJOIN #c2channel\nPRIVMSG #c2channel :beacon' | nc -w 3 127.0.0.1 6667 2>/dev/null || trueExpected Telemetry
Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.
Expected Detection
Network monitoring should flag outbound IRC connections (port 6667/6697) as anomalous. Alert fires on connection to known IRC port from a non-IRC client process.
Simulates HTTP-based C2 beaconing using a User-Agent string commonly associated with Cobalt Strike default malleable profiles. Makes 10 periodic HTTP GET requests at 5-second intervals to localhost.
Command
for /L %i in (1,1,10) do (
powershell -Command "Invoke-WebRequest -Uri 'http://127.0.0.1/pixel.gif' -UserAgent 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)' -ErrorAction SilentlyContinue" 2>nul
timeout /t 5 /nobreak >nul
)Expected Telemetry
Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.
Expected Detection
Alert fires on regular-interval HTTP connections from PowerShell. Proxy-based detections should flag the anomalous User-Agent string. BeaconScore=high due to consistent 5-second interval.