Becons

Resources

• Becons & Sessions : https://allenace.medium.com/understanding-sliver-c2-framework-beacon-and-session-modes-6324f74d9d43
• OPSEC
  • BeconForge: https://github.com/Kiliankm19/BeaconForge/blob/main/learn/01-CONCEPTS.md#beacon-behavior-patterns

Notes

General

• Beacon implants offer flexibility, you can convert them to interactive sessions using the interactive command. However, this conversion only works with protocols compiled into the implant. For example, if your beacon wasn’t built with HTTP support, you cannot establish an HTTP-based session later. When you’re finished with an interactive session, the close command returns the implant to beacon mode but Session-mode implants lack this flexibility. Once compiled for session mode, they cannot switch to beacon functionality.

Becons Opsec

1. Sleep and Jitter (Timing Evasion)

• Sleep: The baseline interval the beacon waits before checking in with the server.
• Jitter: A randomized percentage variation applied to the sleep time (e.g., a 60-second sleep with 30% jitter means the beacon checks in randomly between 42 and 78 seconds).
• Why: Destroys statistical, metronomic network patterns. Defeats simple SIEM rules looking for exact interval polling.

2. Heartbeats (Liveness Check)

• Mechanism: Periodic, minimal check-ins containing just the beacon ID.
• Why: Updates the last_seen timestamp on the C2 database so the operator knows the implant is still alive, even when no active tasks are queued.

3. Reconnection Strategy (Resilience)

• Mechanism: Exponential backoff (e.g., wait 2s, then 4s, 8s, up to a max cap like 300s).
• Why: Prevents a disconnected fleet of beacons from inadvertently DDoSing the C2 server or creating massive network noise when a firewall resets connections.

4. Malleable C2 Profiles (Traffic Shaping)

• Mechanism: Configuration files that alter the outward shape of the traffic without changing the underlying malware.
• Why: Wraps payloads in fake HTTP headers, User-Agents, or cookies to blend in with normal business traffic (e.g., mimicking a Windows Update check or Google Analytics). Defeats static network signatures.

5. Chunking & Asymmetric Egress (DLP Evasion)

• Mechanism: Splitting large exfiltrated files into tiny byte chunks sent over hours, often switching from HTTP GET (for check-ins) to HTTP POST (for data staging).
• Why: Avoids tripping Data Loss Prevention (DLP) volume alarms on the firewall.

6. Domain Fronting / Proxies (Infrastructure Hiding)

• Mechanism: Routing C2 traffic through legitimate, high-trust CDNs (like Cloudflare or AWS).
• Why: Masks the true IP of the attacker’s server. Defenders cannot simply IP-block the C2 without breaking legitimate business services.