↳ GitHub sourceAnalytics ruleLow

Potential beaconing activity (ASIM Network Session schema)

Description

This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56). This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema'

Rule type: Scheduled
Version: 1.1.6
Declared status: Available
Query frequency: 1d
Query period: 2d
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AWSS3 MicrosoftThreatProtection SecurityEvents WindowsSecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights)AzureFirewall AzureNSG CiscoASA CiscoAsaAma Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki

Data types

AWSVPCFlow DeviceNetworkEvents SecurityEvent WindowsEvent CommonSecurityLog Syslog VMConnection AzureDiagnostics Corelight_CL VectraStream CiscoMerakiNativePoller

KQL query

Original query, unchanged.

let querystarttime = 2d;
let queryendtime = 1d;
let TimeDeltaThreshold = 10;
let TotalEventsThreshold = 15;
let PercentBeaconThreshold = 80;
let LocalNetworks=dynamic(["169.254.0.0/16","127.0.0.0/8"]);
_Im_NetworkSession(starttime=ago(querystarttime), endtime=ago(queryendtime))
| where not(ipv4_is_private(DstIpAddr))
| where not (ipv4_is_in_any_range(DstIpAddr, LocalNetworks))
| project 
    TimeGenerated
    , SrcIpAddr
    , SrcPortNumber
    , DstIpAddr
    , DstPortNumber
    , DstBytes
    , SrcBytes
| sort by 
    SrcIpAddr asc
    , TimeGenerated asc
    , DstIpAddr asc
    , DstPortNumber asc
| serialize
| extend 
    nextTimeGenerated = next(TimeGenerated, 1)
    , nextSrcIpAddr = next(SrcIpAddr, 1)
| extend 
    TimeDeltainSeconds = datetime_diff('second', nextTimeGenerated, TimeGenerated)
| where SrcIpAddr == nextSrcIpAddr
//Whitelisting criteria/ threshold criteria
| where TimeDeltainSeconds > TimeDeltaThreshold 
| project
    TimeGenerated
    , TimeDeltainSeconds
    , SrcIpAddr
    , SrcPortNumber
    , DstIpAddr
    , DstPortNumber
    , DstBytes
    , SrcBytes
| summarize
    count()
    , sum(DstBytes)
    , sum(SrcBytes)
    , make_list(TimeDeltainSeconds) 
    by TimeDeltainSeconds
        , bin(TimeGenerated, 1h)
        , SrcIpAddr
        , DstIpAddr
        , DstPortNumber
| summarize
    (MostFrequentTimeDeltaCount, MostFrequentTimeDeltainSeconds) = arg_max(count_, TimeDeltainSeconds)
    , TotalEvents=sum(count_)
    , TotalSrcBytes = sum(sum_SrcBytes)
    , TotalDstBytes = sum(sum_DstBytes)
    by bin(TimeGenerated, 1h)
        , SrcIpAddr
        , DstIpAddr
        , DstPortNumber
| where TotalEvents > TotalEventsThreshold 
| extend BeaconPercent = MostFrequentTimeDeltaCount/toreal(TotalEvents) * 100
| where BeaconPercent > PercentBeaconThreshold

Declared entities

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml ↗
Commit: 9800e51 ↗
Source identifier: fcb9d75c-c3c1-4910-8697-f136bfef2363

Additional source files 3

Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yamlsource ↗Detections/ASimNetworkSession/PossibleBeaconingActivity.yamlmigration-note ↗Solutions/Network Session Essentials/Data/Solution_NetworkSessionEssentials.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.