A Few Dollars to Disappear: Breaking C2 Beaconing Detection

Most C2 beaconing detections are built around a familiar set of assumptions: connections repeat at measurable intervals, sleep and jitter remain relatively stable, and enough traffic reaches the same destination to establish a pattern. Those assumptions do not always reflect how an adversary actually operates. In this talk, I will examine how specific C2 operating modes alter timing, volume, and communication patterns in ways that automatically evade common beaconing-detection techniques. I will also demonstrate how inexpensive infrastructure changes can fragment the observable signal and reduce it below the practical detection threshold of current algorithms—without requiring sophisticated traffic shaping or custom malware. We will break down the characteristics commonly used by beaconing detectors, examine where those characteristics fail, and test them against traffic representing realistic adversary operations rather than continuously running laboratory beacons. The talk will include an analysis of the current RITA beaconing algorithm and examples showing how different operational behaviors affect its results. Detection is still possible, but it requires moving beyond periodicity alone. I will present practical guidance to improve detection coverage. To support further research, I will share: - A highly customizable traffic-generation tool that produces C2 network logs based on realistic operator behavior - The datasets used during the presentation - Jupyter notebooks containing an implementation and analysis of the current RITA beaconing algorithm Attendees will leave with a clearer understanding of the assumptions hidden inside current beaconing detections, how adversaries can exploit them, and how to test their own detections against more realistic C2 traffic.