# How to detect lateral movement and C2 beaconing

> What lateral movement and command-and-control beaconing look like on the network, mapped to MITRE ATT&CK techniques, and how to detect them in practice.

Source page: https://netsenx.com/en/detect-lateral-movement-c2-beaconing

Last reviewed: November 6, 2026

Lateral movement is an attacker spreading from the first compromised machine to others, usually by signing in with stolen credentials over remote services. Command-and-control (C2) beaconing is compromised software checking in with the attacker's server at regular intervals for instructions. Both have to cross the network, so both can be detected from network traffic even when it is encrypted: lateral movement as unusual host-to-host sessions on administration protocols, beaconing as a steady rhythm of small connections to one destination.

## The fact to plan around

In joint guidance published on 7 February 2024, CISA, the NSA, the FBI and partner agencies warned that attackers who "live off the land" use the same legitimate tools as administrators, so their activity blends in with normal operations, and recommended keeping baselines of normal network, user and administrative activity in order to spot what deviates from them.

Source: [CISA, NSA, FBI and partner agencies — Joint guidance: Identifying and mitigating living off the land techniques, 7 February 2024 (published by NCSC New Zealand)](https://www.ncsc.govt.nz/protect-your-organisation/identifying-and-mitigating-living-off-the-land-lotl-techniques/)

## How to detect them

Four practices that work with any tooling, and that NetSenX automates.

1. **Keep a baseline of who talks to whom** Lateral movement is only visible against what is normal. Record which hosts usually connect to which servers, and on which ports: a workstation that suddenly opens SMB or RDP sessions to ten servers stands out against that baseline.
2. **Watch east–west traffic, not only the perimeter** Host-to-host traffic inside the LAN never crosses the internet firewall. Put a SPAN or TAP port, or a sensor, inside each segment you need to see.
3. **Look for rhythm, not content** Beaconing shows up as connections to one destination at near-constant intervals, often with small, similar-sized messages and a little random jitter. Timing and volume stay visible when the session is encrypted.
4. **Correlate across hosts** Several hosts beaconing to the same new domain, or one host scanning and then signing in to the machines it scanned, is a stronger signal than any single connection.

## Mapped to MITRE ATT&CK

Technique names and IDs are MITRE's. The last column names the NetSenX detection category this traffic falls under; it does not mean every variant of the technique is caught.

| Technique | What it looks like on the network | NetSenX detection |
|---|---|---|
| [T1046](https://attack.mitre.org/techniques/T1046/) Network Service Discovery (Discovery) | One host connecting to many internal addresses or ports within a short time. | Scanning |
| [T1021](https://attack.mitre.org/techniques/T1021/) Remote Services (Lateral Movement) | A workstation opening SMB, RDP, SSH or WinRM sessions to servers or other workstations it has never used before. | Lateral movement |
| [T1071](https://attack.mitre.org/techniques/T1071/) Application Layer Protocol (Command and Control) | Small, regular connections to the same external destination over HTTPS, day and night. | C2 beaconing |
| [T1573](https://attack.mitre.org/techniques/T1573/) Encrypted Channel (Command and Control) | The same rhythm inside TLS: timing, volume, destination and the handshake stay visible without decryption. | C2 beaconing, from metadata |
| [T1041](https://attack.mitre.org/techniques/T1041/) Exfiltration Over C2 Channel (Exfiltration) | A beaconing host that suddenly sends much more data out over the same channel. | Unusual outbound data volume |
| [T1048](https://attack.mitre.org/techniques/T1048/) Exfiltration Over Alternative Protocol (Exfiltration) | Large outbound transfers over a protocol the host does not normally use for that. | Unusual outbound data volume |

## What NetSenX does today

- Detects scanning, lateral movement, C2 beaconing and unusual outbound data volume from network behaviour, on every plan, Free included.
- From the Pro plan, correlates hosts into a graph of who talks to whom, so a scan followed by new remote sessions, or several hosts beaconing to one destination, appears as one story instead of scattered alerts.
- Names the MITRE ATT&CK technique on the alert where a detection corresponds to one, and shows in a coverage view which techniques your enabled detections address.
- Analyses encrypted traffic from timing, volume and destinations, and from the Starter plan also from the TLS handshake, and never decrypts it. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.

## What NetSenX does not do

NetSenX sees lateral movement only where it crosses a segment you monitor: a session between two hosts on an unmonitored segment, or activity that stays inside one machine, is out of its view. It does not read the content of encrypted sessions, it does not replace incident response, and it does not claim to catch every variant of every ATT&CK technique listed on this page.

## Questions buyers ask

### What is lateral movement in cybersecurity?

Lateral movement is how an attacker spreads from the first compromised machine to others, typically with stolen credentials over remote services such as SMB, RDP, SSH or WinRM. MITRE ATT&CK lists it as tactic TA0008; Remote Services is technique T1021.

### How do you detect C2 beaconing?

Look for one host connecting to the same external destination at near-regular intervals, around the clock, with small messages of similar size. The pattern shows in flow data and firewall logs, and in encrypted traffic too, because timing, volume and destination are not encrypted.

### Can you detect lateral movement in encrypted traffic?

Largely, yes: who connects to whom, on which port, when and how much data moves are all visible without decryption. What stays hidden is the content of the session, such as the commands sent over an encrypted remote session.

### Which MITRE ATT&CK techniques can network detection see?

The ones that create traffic between machines, for example Network Service Discovery (T1046), Remote Services (T1021), Application Layer Protocol (T1071), Encrypted Channel (T1573) and Exfiltration Over C2 Channel (T1041). Techniques that stay inside one host are for endpoint tools to see.

## Sources

- [CISA, NSA, FBI and partner agencies — Joint guidance: Identifying and mitigating living off the land techniques, 7 February 2024 (published by NCSC New Zealand)](https://www.ncsc.govt.nz/protect-your-organisation/identifying-and-mitigating-living-off-the-land-lotl-techniques/)
- [MITRE ATT&CK — Lateral Movement (TA0008)](https://attack.mitre.org/tactics/TA0008/)
- [MITRE ATT&CK — Command and Control (TA0011)](https://attack.mitre.org/tactics/TA0011/)

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

## Related pages

- [How to tell if someone is inside your network](https://netsenx.com/en/is-someone-inside-your-network)
- [How to detect ransomware on the network](https://netsenx.com/en/detect-ransomware-on-the-network)
- [Encrypted traffic analysis](https://netsenx.com/en/encrypted-traffic-analysis)
- [NDR vs EDR vs SIEM](https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem)
- [Features](https://netsenx.com/en/features)
- [NIS2 network monitoring](https://netsenx.com/en/nis2-network-monitoring)