# Beaconing & C2 Traffic Identification

> Master the detection of Command and Control channels. Learn to identify rhythmic beaconing, calculate jitter, and hunt for covert C2 traffic hiding in DNS, HTTP, and TLS.

Canonical: https://codelivly.com/rooms/beaconing-c2-traffic-identification
Last updated: 2026-07-06

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the heartbeat of a compromised network. The Beaconing & C2 Traffic Identification module breaks down how attackers maintain persistent access and how SOCs can detect their rhythmic callbacks.

You will learn how to mathematically identify C2 beaconing intervals and jitter, deconstruct default and custom Malleable C2 profiles (like Cobalt Strike), and hunt for covert channels hiding inside DNS, HTTP, and encrypted TLS traffic. By the end of this module, you will be able to build advanced SIEM queries that catch stealthy adversary communications that bypass traditional IDS signatures.

## Lessons

1. What is C2? (30 min)
2. Beaconing Patterns & How to Spot Them (30 min)
3. Identifying Malware Traffic in Captures (30 min)
4. Case Study: Analyzing a Real C2 Beacon Sample (30 min)

## Related

- [Learning path: Endpoint & Network Security Monitoring](https://codelivly.com/learning-paths/endpoint-network-security-monitoring)
- [All rooms](https://codelivly.com/rooms)