It is very common for active malware to "call home" (or beaconing), either to fetch updates and instructions or to send back stolen information..

In an internal network where web access to the Internet must go through a proxy, the traffic that doesn't pass through the proxy and by default is dropped by the gateway firewall could be valuable to detect malware call-home activities.

What are the techniques to detect malware call home/beaconing activities?

  • 2
    Malware can use proxy settings, so they will go with the common traffic.
    – ThoriumBR
    Sep 24, 2018 at 11:29
  • @ThoriumBR Not always. Malwares can use a proxy to tunnel stolen information or some sort of command it awaiting for to hand on.
    – slayer
    Oct 5, 2018 at 13:18
  • To answer your question, known ways to hide malware network communications shall be listed first followed by the techniques to nullify the hiding techniques used by the malware to call back home. The techniques to detect shall evolve with hiding techniques. If you attest this method is correct way to attempt an answer to question of your, I am willing to make an effort to get it for you. May 30, 2020 at 10:06
  • That will be very helpful @ArpitRohela
    – Filipon
    May 30, 2020 at 10:08
  • Consider becoming familiar with MITRE - ATT@CK - For this Command and Control is probably the most useful vertical in the Matrix. attack.mitre.org/tactics/TA0011 consider the others for overlap. May 30, 2020 at 12:37

8 Answers 8


There are a number of ways to do this, largely depending on the logs available, the exact nature of your network and the strain of malware you're infected with.

Malware can and will use your proxy, it can and will use your nameservers, it can and will run under the context of a normal user.

If you're effectively going in blind, with no indicators of concern, you could use the below to pick out potential malware traffic;

  • Web traffic to a domain no other device is communicating with
  • Web traffic to domains with known risky TLDs (.top, .gq for example)
  • Large amounts of DNS traffic originating from a user endpoint
  • Periodic traffic which calls out with a precise interval
  • Proxy traffic on odd ports
  • Proxy traffic which remains out of hours
  • HTTP traffic with commands within the URI (i.e, a web shell)
  • Unusual user agent strings
  • Proxy traffic which remains out of hours - what does it mean? can you elaborate?
    – Filipon
    Sep 24, 2018 at 13:40
  • 1
    This depends on your environment but out of normal working hours, so 18:00 - 06:00 perhaps if you're monitoring a typical office. If you're monitoring a home network, you could look at any time when you're not using the device. (i.e, is there traffic occurring when nobody is using the machine?)
    – Doomgoose
    Sep 24, 2018 at 13:43
  • Can you elaborate on "Unusual user agent strings", please? Mar 18, 2020 at 10:53

What are the techniques to detect malware call home/beaconing activities?

As we discussed in the comments sir, following are the broad known ways to hide malware network communications followed by ways to detect them. I have generalized some info because I am no expert in malware analysis. Hopefully below information serves help.

0> Direct IP connections, typically for malware that doesn’t make use of DNS.

Technique to detect:

  • Identify the IP string and push it to a service detecting if the IP resolves to any domain and if the domain is safe/suspicious or not.
  • Manually visit the IP under isolated environment and latest browser to poke around and know more.

1>Domain Generation Algorithm (DGA)

Malware with domain generation capabilities can periodically modifying C&C address details and using unknown addresses. It defeated/can defeat the Web Security Gateway (SWG), Terminal Detection Response (EDR) and Sandbox.


1> Domain Name System (DNS) to resolve a C&C server address.

detection technique that may help:-

  • Statistics for DNS queries on the full qualified domain name (FQDN) focusing on the second-level domain. Be aware that this can also generate lots of false positives due to content delivery networks (CDNs);
  • Look for DNS responses that have a very low time to live (TTL)
  • Look for Alerts on DNS queries for domains that have only recently been registered
  • Look for DNS responses that have a very low time to live (TTL)
  • Look for repeated requests for domains belonging to a dynamic DNS service or requests for URL shortener domains
  • Look for repeated requests for domains belonging to a dynamic DNS service
  • The log files of your internal DNS server are a crucial source of information.
  • Note that DNS traffic itself can also be used as a communication channel

2>Host fraud

Forging header information can confuse the true destination of the data, so it can bypass defensive measures against known C&C server addresses. It defeated/can defeat the Web Security Gateway (SWG), IPS / IDS and Sandbox.

detection technique that may help:- take following important general measures to strictly limit these malware:

  • Only multi-layer protective measures can achieve complete safety coverage combination of endpoint defense (such as antivirus software and network layer protection measures such as firewalls and Web security gateways) .

  • Focus on zero-day malware: need of malware defense mechanism that can clearly identify and detect zero-day malware.

  • Perform traffic analysis: the infection may come from user endpoints, attackers usually extend it to network resources. Thus consider focusing not only on a certain area or resource type, but also network in its entirety

  • Leveraging big data: collect massive amounts of information accumulated over time to detect malware activities worldwide and correlate seemingly unrelated activities to track the development & evolution of malware.

3> web traffic:-Corporate environments often require that users’ web traffic goes through a filtering proxy. The web proxy logs are also helpful for detecting and analyzing C&Cs.

detection technique:-

  • Web requests with an unusual HTTP protocol version.
  • User agents that are not commonly used in your organization.
  • Do not blindly trust user agent information, however, since this can easily be crafted.
  • Look for excessive size or a repeating pattern in the size of HTTP requests;
  • Look for persistent connections to HTTP servers on the internet, even outside regular office hours;
  • Look for repeated requests for the same web resource, possibly on different domains, with a similar parameter format;
  • Look for requests to a social network site outside regular office hours.
  • Some particular sample uses it's own custom protocol that it sends over SSL/TLS.
  • Look for repeated requests for URL shorten-er domains;
  • Security teams can spot traffic related to already-known attack campaigns by using threat intelligence feeds. Most proxies will also support block lists based on these feeds.

4>Mail:-Not all C&C communication has to be web-based; it can also happen via email.

detection technique:-

  • Although email logs rarely contain the full conversation, the metadata can be helpful. Verify with your legal department under what conditions storage and access to this information is allowed and use it to look for suspicious information

5>internet relay chat (IRC) or peer to peer (P2P):-Firewall logs can shed light on other forms of C&C communication via internet relay chat (IRC) or peer to peer (P2P) exchange.

detection technique:-

  • Seeing an outgoing connection attempt might be enough to tip off an investigation.
  • Netflow(name is not intended to recommend a product here) statistics for workstations that establish a high number of connections or flows(this is a general tip too)

6> network steganography (a crucial tool):

(interesting irrelevant info, feel free to skip if not interested)

The secret is injected into network traffic. For example, the data can be cloaked by manipulating the content of unused flags within headers or by modulating the inter-packet time (IPT) of network flow datagrams. In the latter case, asender can encode bits of information in previously agreed-upon IPT values. Similar to the LSB modification of image’s pixels example, overly aggressive deviations would make it possible to differentiate the hiding process from normal jitter events. Therefore, hidden channels are typically characterized by a low bandwidth, often ranging from a few to a few hundreds bits per second. Today, many other methods enable covert communications among desktops or digital devices, including generating inaudible sounds or utilizing a smartphone’s sensors to receive a sequence that activates a threat

technique to detect:-

  • If you have the infrastructure for recording full packet captures, this can be a very useful resource for hunting for C&Cs. Make sure the packet data is indexed and easily searchable. The searches can be based on the information previously found via the firewall logs or netflow records.

credits and respect:




One Chinese site I converted text to English from, respect for the info but unfortunately I can not mention it because it was hosted on http(not https so skeptical about recommending such site to visit.)

Hopefully this information serves help. Please feel free to edit this answer to add information or credits I missed to mention.

In the case the malware uses a DGA (Domain Generation Algorithm) to contact the C&C server, analyzing the DNS queries can be useful.

Detecting 'homecalls' can be done by a clustering the meta-data of the DNS queries or doing statistical analysis on the queried host-name itself.

Detecting whether a queried domains is legit of malicious can also be done with a machine learning classifiers. There are good open source classifiers like FANCI or Endgame out there. FANCI is a random forest classifier, whereas Endgame is a Deep-Learning classifier. Both have their ups and downs. The machine learning algorithms could be trained to fit your personal needs by retraining them on your own data. The downside of this, is that you need to have lots of clean and malicious data available, which is often not the case.

The results of the machine learning classifiers seem promising. However they can also be circumvented using adversarial examples.

Note that this is not a complete answer, just one possible proposition to solve the problem.


I really agree with Doomgoose's answer, but i would like to also propose something different. If you have detected the malware you can isolate it and perform some basic dynamic analysis. In this case, I would put the malware in a virtual machine where it could have network access, run the malware, so it can go reach its "home" and analyze the traffic, either through wireshark, or other tools that do this as part of their dynamic analysis routine for malwares. Once its traffic is identified, you can make rules for ids/ips/firewalls/whatever, so you can further detect the spread in a big network and/or block it. Apart from that, you will save a great deal of time analyzing logs which may also contain numerous lines of legitimate traffic between the ones of the malware.


DNS Beacons are the most common based on my experience, also watch out for systems communicating within your network using Let's Encrypt Certificates and "looks" like Amazon Web Service, but in reality they are not of course. These are signs of hacker trade craft. You can find more information about this by Googling for "Malleable C2"


There are different methods of detecting a malware's attempt to communicate with its command and control server. In my opinion, the best way to perform a dynamic analysis of a malware is to analyse it in an isolated VM running FakeNet.

When a malware is executed, it uses different methods to establish network connectivity. It's goal is to establish comms with its C&C. Some do it either by pinging well known public sites such as Google or even

FakeNet responds to such requests with a fake reply by simulating a network, making the malware believe that it has an internet connection. Logs can be exported in .pcap format and analysed separately. You can read more on FakeNet here


To my knowledge the most prevalent technique is to leverage a DNS sinkhole which analysis any particular type of outgoing requests.

  • 3
    Why a DNS sinkhole? How does a sinkhole help in this use case? How do you use a sinkhole to analyze? I think you need to expand on this answer a lot more, because there is not enough detail in general, and sinkholes are certainly not the "most prevalent" technique to analyse traffic of any sort, unless I am missing something.
    – schroeder
    Sep 24, 2018 at 12:51

Another technique that you can add to your list is the use of honeypots, in general malware tries to spread over the home network in order to find other victims, honeypots helps to detect this.

  • "spreading" is not a "call home" activity
    – schroeder
    Oct 1, 2018 at 20:34
  • @camp0 I believe that you have a misunderstand of what a well-known "Malware Call Home" is. The "Home" refers to the whose host that the Malware tries to communicate to follow some command (i.e., C2) or store ripped off information from the infected computer/device
    – slayer
    Oct 5, 2018 at 12:51
  • @camp0 The use of honeyspot [and honeynet]––since it is utter isolated from the major network––is a good method to obtain the Malware and analyze their behavior. Despite this subject is not being discussed here, though. That's why I gave you a down voted.
    – slayer
    Oct 5, 2018 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .