Detecting Low-and-Slow Beaconing in Endpoint Telemetry

Why interval checks fail

Beaconing that randomizes jitter within narrow bounds blends into normal task scheduling. We focus on sequence stability instead of strict timing.

Signal construction

We build a rolling ratio between event spacing and host-level background noise, then evaluate rank stability.

# Example: aggregate process launch intervals per host
cat telemetry.jsonl | jq -r '.host,.ts' | python tools/intervals.py

Results

The approach flags scheduled callbacks with a variance band that would otherwise clear a fixed threshold.

Defensive follow-up

Pair the signal with outbound destination entropy for the same process lineage. This removes most benign updaters.