Detecting C2 Beaconing in Sysmon Telemetry

Why this matters

Sysmon is one of the richest free sources of host telemetry, but that richness is also the problem: a busy workstation generates a continuous stream of EventID 3 network connections, and a command-and-control beacon is a handful of those events hiding among thousands of legitimate ones. The signal that separates “a process made an outbound connection” from “this process is talking to a live Cobalt Strike server” is almost never in the connection event by itself — it is in the reputation of the destination and the lineage of the process that opened it. Both are present in Sysmon; they just have to be correlated.

Indicators to look for in Sysmon telemetry

• EventID 3 (NetworkConnect) with a DestinationIp outside your known SaaS/CDN ranges, often on a non-standard DestinationPort (our sample: 185.220.101.42 on 4444)
• EventID 1 (ProcessCreate) with a CommandLine containing powershell -enc or another base64 blob — the loader that stages the beacon
• EventID 22 (DNSQuery) resolving a suspicious QueryName such as malware-c2.ru, with the QueryResults pointing at the same IP the host later connects to
• Repeated EventID 3 connections from the same Image at a regular interval — beacon cadence rather than human-driven traffic
• A short chain where an encoded-PowerShell process, a network connection to a bad IP, and a matching DNS query all share a timeframe and a host

How LogTriage detects this

The Sysmon parser maps each event by EventID: EventID 3 becomes a network event whose path is DestinationIp:DestinationPort and whose DestinationIp is fed to threat-intelligence enrichment, while EventID 1 preserves the full CommandLine. Two independent scoring rules then fire on our sample. The NetworkConnect’s destination, 185.220.101.42, is a confirmed Tor-exit range already in LogTriage’s malicious CIDR table, and a single confirmed-malicious verdict floors that event’s risk score to 75 regardless of the additive base. Separately, the encoded-PowerShell loader matches the host-attack signature for obfuscated PowerShell execution and floors that event to 70 — this floor exists precisely because host telemetry carries no user-agent or ASN for the pipeline to score on otherwise. The EventID 22 DNS query to malware-c2.ru is preserved as the event path, giving you the domain-level pivot for hunting the same C2 elsewhere.

Detection / evidence checklist

• List every EventID 3 destination the suspect process contacted, with timestamps, and check each IP against current threat intelligence rather than a stale internal blocklist
• Pull the EventID 1 CommandLine for the process and its parent — an encoded-PowerShell or LOLBin loader is the confirmation that the connection is not benign
• Cross-reference EventID 22 QueryName/QueryResults to establish which C2 domain resolved to the connected IP
• Look for regular-interval repetition in the EventID 3 records — cadence is a stronger signal than any single connection
• Isolate the host and rotate any credentials active in a session on it during the beacon window, then trace the process tree back to the initial infection vector