Network investigation guide
Investigating HTTPS Beacons
An HTTPS beacon is a recurring pattern of short connections from one device to the same internet endpoint, often with little data returned.
Understand the finding
What do HTTPS Beacons mean?
Malware uses beaconing to check in for instructions, but updates, telemetry, notifications, and monitoring agents can look similar. Destination reputation, timing, process attribution, and novelty help separate them.
Triage workflow
How to investigate HTTPS Beacons
- 1
Measure the interval regularity, duration, destination stability, and data exchanged.
- 2
Identify the initiating process, executable reputation, parent process, and installation path.
- 3
Review domain age, reputation, ownership, popularity, and prior contact history.
- 4
Look for payload growth, tasking, downloads, lateral movement, or other host detections.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- Software updates, telemetry, crash reporting, and analytics
- Email, chat, calendar, notification, and certificate-status polling
- Monitoring agents or applications retrying an unavailable service
Make a decision
When to escalate or de-escalate
Escalate when
- An unknown or suspicious process contacts a new or low-reputation endpoint with regular timing.
- Beaconing coincides with downloads, commands, persistence, credential access, or lateral movement.
De-escalate when
- The process and endpoint belong to a verified, approved application.
- The timing and destination match a documented update, telemetry, or monitoring service.
Analyze the evidence
Investigate network behavior with Red Hand Analytics
Upload a PCAP or connect Red Hand Collector. Both use Red Hand Analytics, where meaningful behavior, endpoints, DNS, data flows, and connection evidence stay connected.