Beaconing
The same lookup, almost exactly on schedule
Volume is not the only tell. Here one client asks for a single name every few seconds with machine-like regularity. Nothing about the name is unusual — the timing is the signal.
- Regular intervals are a behavioural signal independent of the name itself
- Implants check in on a timer, sometimes with deliberate jitter
- Plenty of legitimate software also polls on a schedule
Queries/minRate across all simulated clients in this scenario.
60
AllowedLookups the simulated resolver answered normally.
1
BlockedLookups a policy or feed prevented.
0
FindingsDetections raised by the simplified demonstration model.
0
NXDOMAIN %Share of lookups for names that do not exist.
0.0%
Unique domainsDistinct names seen — high cardinality is itself a signal.
1
TXT queriesTXT and NULL lookups. Normal in small amounts.
0
Avg entropyBits per character of the leftmost label. Readable names sit near 2.5.
2.00
Query flow
How each simulated lookup is handled
Device
DEMO-DESKTOP-02
DNS query
CNAME chat.example.com
DNS Daddy
resolver + policy
Signals
0 of 4 firing
Outcome
Allow
Event stream
Synthetic queries. Select a row to inspect it.
| Time | Device | Type | DNS query | Result |
|---|---|---|---|---|
| 13:42:00 | DEMO-DESKTOP-02192.0.2.32 | chat.example.com | Allowed |
Devices on the simulated network
Per-device behaviour, measured over the run
DEMO-LAPTOP-01192.0.2.21
Staff laptop
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
DEMO-DESKTOP-02192.0.2.32
Reception desktop
- queries
- 1
- unique
- 1
- entropy
- 2.00
- nxdomain
- 0%
DEMO-LAB-CLIENT192.0.2.42
Isolated lab host
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
DEMO-PHONE-04192.0.2.70
Mobile device
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
DEMO-NAS-05192.0.2.91
File server
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
Detection model
Signals accumulate as behaviour changes
Signals
- Highly regular query interval+0 of 32not yet observed
- Same name repeatedly, defeating cache expectations+0 of 18not yet observed
- Pattern sustained over time+0 of 20not yet observed
- Periodic TXT lookups within the pattern+0 of 12not yet observed
Simplified demonstration model. Each signal adds a fixed number of points; reaching 65 generates a finding. Real detection engines weigh signals dynamically — this version is written to be readable, and is not production telemetry.
Attack timeline
How the scenario unfolds
- 1Normal, irregular traffic across the labnow
- 2One client begins resolving a single name on a timer
- 3Interval consistency becomes measurable
- 4Regularity and repetition signals fire
- 5Pattern persistence pushes risk over the threshold
- 6Finding generated
- 7Analyst identifies the responsible process
Threat hunting mode
Find the affected device before the model tells you
Hunting mode hides the finding and the highlighted device. You read the raw stream and per-device measurements, then name the device you think is compromised.
Keep going
Compare this against another pattern