Tailscale Premium: Beaconing candidates (regular periodic flows)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies flows that recur at a highly regular interval, which is the signature of C2 beaconing or scheduled exfiltration jobs. Looser threshold than the analytic rule - investigation aid.

Attribute	Value
Type	Hunting Query
Solution	Tailscale (CCF)
ID	b28cbdd2-8cef-be9b-a38e-7faceedfdbec
Tactics	CommandAndControl, Exfiltration
Techniques	T1071, T1095, T1029
Required Connectors	TailscalePremiumCCF
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
Tailscale_Network_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Tailscale (CCF)