DOCSEARCHbyAlgolia
Submit Docs

BeaconHunter Documentation

repository·main·Indexed 19 days ago

https://github.com/3lp4tr0n/beaconhunter

A behavior-based monitoring and hunting tool built in C# that leverages ETW tracing to detect and respond to Cobalt Strike beacons. It monitors processes for suspicious thread activity, including network callbacks, DNS queries, and shell commands, and provides manual or automated thread suspension based on a calculated Network Beacon Score.

Tokens
564
Snippets
2
Records
5
Agent score
18%

What's inside BeaconHunter

  1. Understand the Network Beacon Score

    main

    The Network Beacon Score is used to identify rhythmic callback patterns typical of Cobalt Strike beacons.

    Calculation Logic:

    1. Calculate the time difference (delta) between consecutive beacon callbacks.
    2. Calculate the 1st derivative of that delta.
    3. Apply the inverse function 100/x (where x is the 1st derivative of delta) to produce the final score.

  2. Monitor suspicious thread activity

    main

    BeaconHunter uses ETW (Event Tracing for Windows) to monitor processes containing threads in a Wait:DelayExecution state. It specifically tracks the following suspicious behaviors:

    • Network Callbacks: HTTP/HTTPS activity.
    • DNS Queries: Used to detect DNS-based beacons.
    • File System Activity: Commands like cd, ls, upload, and rm.
    • Process Termination: The kill command.
    • Shell Commands: Commands like run or execute (includes detection for PPID spoofing).

  3. Install BeaconHunter

    main

    You can install BeaconHunter using one of the following methods:

    Pre-compiled Binaries

    Download the latest release from the GitHub Releases page or clone the repository and navigate to the Release folder.

    Building from Source (.NET Framework 4.5)

    If you are building the project manually, ensure you have the following NuGet packages installed via the Package Manager Console:

    Install-Package ConsoleTables -Version 2.4.2
Install-Package Microsoft.Diagnostics.Tracing.TraceEvent -Version 2.0.64
Install-Package System.Runtime.InteropServices.RuntimeInformation -Version 4.3.0
    Install-Package ConsoleTables -Version 2.4.2
Install-Package Microsoft.Diagnostics.Tracing.TraceEvent -Version 2.0.64
Install-Package System.Runtime.InteropServices.RuntimeInformation -Version 4.3.0

  4. Take action against suspicious threads

    main

    BeaconHunter provides two ways to respond to detected threats:

    Manual Thread Suspension

    You can manually suspend a specific Thread ID identified during monitoring.

    Automated Thread Suspension

    You can configure a score threshold. If a Network Beacon Score exceeds this threshold, BeaconHunter will automatically suspend the offending thread.