From Bits to Behavior: Detecting macOS Com & Con Through Statistical Analysis

The talk argues that command and control traffic, though built to be stealthy, leaves statistical patterns in macOS logs. It opens with a short overview of C2 frameworks and why attackers favour beaconing, where an implant calls back to its server at regular intervals with some randomness, known as jitter. The speaker contrasts signature-based and behavioural detection and explains why universal behaviour such as beaconing holds up better than indicators that change with each campaign.

The core method estimates two values per process: the callback rate, from the request count over a time window, and the jitter, from the second-order difference between requests. Plotting these values per process shows a region where malicious processes separate from expected ones such as chat or IDE tools. Thresholds are chosen by accepting an acceptable false-positive rate, then refined through iteration and testing against real C2 channels and benign activity. Allow-listing by process, command line, parent and port reduces noise further. The pipeline uses OSQuery to collect socket events, ships them to an Elastic cluster, and runs the calculations in Python.

The main takeaway is that simple, explicit rules are transparent and easy to tune, but they need baselining and ongoing maintenance for each environment. The speaker reports that the detection produces roughly one alert a week for their team. The talk closes by noting that long-lived interactive sessions fall outside this beacon-focused approach and would need a separate method.