Hunting for beacons

This blog explains a lightweight, anomaly-based method to detect C2 beaconing by analyzing inter-connection timing (sleep and jitter) between connection pairs (e.g., IP->host) across log sources. It covers how uniform jitter produces detectable timing bands, how the model adapts to configuration changes, expected false positives from benign scheduled traffic, and practical applicability for network hunting.