# Defense Network Detection

> Detect attacker activity in network telemetry — C2 beaconing, DNS tunnelling, data exfil, and lateral movement. Load for "detect C2", "find beaconing", "network monitoring / NSM", "suspicious traffic", or building Zeek/Suricata coverage. The defensive counterpart to the offensive network/pivoting skills.

- Skill: `noorqureshi/defense-network-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/defense-network-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/defense-network-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/defense-network-detection

---


# Network detection (NSM)

## When it applies
You have network visibility (a tap/SPAN, Zeek/Suricata logs, or NetFlow) and want to catch activity
that endpoint tooling misses — especially C2 and exfil that look like ordinary connections.

## Why it works
Malware still has to talk. Even encrypted C2 leaks *behavioural* tells the payload can't hide:
regular call-home intervals, tiny requests with large responses, odd JA3/JA4 TLS fingerprints, and
destinations no user browses to. Metadata beats payload inspection in a TLS world.

## Method
1. **Beaconing**: hunt for connections at regular intervals with low jitter to the same destination
   (RITA's beacon analysis over Zeek `conn.log`); score by consistency, not volume.
2. **DNS tunnelling**: high volume of TXT/NULL queries, long/high-entropy subdomains, one domain
   answering for everything — flag on query length + entropy + count per parent domain.
3. **Exfil**: outbound bytes >> inbound to a rare destination, off-hours transfers, upload to
   unsanctioned cloud — baseline egress and alert on the outliers.
4. **Lateral movement**: internal SMB/WinRM/RDP between hosts that never normally talk; new
   admin-share access — east-west, not just north-south.
5. **TLS fingerprinting**: JA3/JA4(S) on the client hello — known-bad or rare fingerprints betray
   tooling even without decryption.

## Gotchas
- Legit software beacons too (update checks, telemetry) — baseline and allowlist, or you drown.
- Encrypted payloads mean you detect *patterns*, not content; don't wait for a plaintext IOC.
- CDNs and cloud fronting make destination reputation noisy — combine signals, don't rely on one.

## Verify success
A controlled C2/exfil reproduction (e.g. a lab beacon) is flagged by the beacon/entropy/egress
logic, while normal baseline traffic stays quiet.

## References
Zeek; Suricata; Active Countermeasures RITA; JA3/JA4; MITRE ATT&CK (Command and Control, Exfiltration).