High severityHARDEC6 steps · 5 phases
Command & Control / Beaconing Eradication
Detection and termination of an active C2 channel / beacon (Cobalt Strike, custom implant).
Information note
Informational note: When cleaning up C2 beaconing, simply terminating the malicious process is not sufficient; perform a threat intelligence analysis that also covers the backup C2 addresses defined in the implant configuration and the malleable profile parameters. Evaluate DNS, HTTP, and named-pipe channels separately under MITRE T1071. Capture a memory image before network isolation to extract the beacon configuration; this enables detection of other implants belonging to the same operator.
1
Preparation
1 steps- Network/DNS telemetry
NetFlow, DNS/proxy logs, TLS inspection, threat intel feed.
2
Detection & Analysis
1 steps- Map the channel
Beacon interval/jitter, C2 domain/IP, hosts carrying the implant, protocol (DNS/HTTPS).
3
Containment, Eradication & Recovery
2 steps- Cut the channel
Block C2 domain/IP via firewall/proxy/DNS sinkhole, isolate affected hosts.
- Remove the implant
Clean implant + persistence on all hosts, reset identities, do simultaneously.
4