What is Botnet?

NIST's glossary entry, quoted in SP 1800-15B from Kaspersky, explains the name: robot plus network. MITRE ATT&CK looks at it from the attacker's side. Under Acquire Infrastructure: Botnet (T1583.005), adversaries buy, lease or rent a network of compromised systems, for example through a subscription to a booter or stresser service; Compromise Infrastructure: Botnet (T1584.005) covers building one. For a SOC the subject splits in two: your machines being recruited into someone's botnet, and someone's botnet aimed at you. The cases below cover both.

Mirai is the reference case for recruitment. CISA's October 2016 alert (TA16-288A) describes a bot that kept scanning the Internet for IoT devices and logged in with a short list of 62 common default usernames and passwords. That was enough to take over home routers, network cameras and DVRs by the hundreds of thousands. It hit Brian Krebs' site with more than 620 Gbps on 20 September 2016, and a separate attack on the French host OVH reached at least 1.1 Tbps. The source code went public at the end of that month. CISA's advice was concrete: monitor 23/TCP and 2323/TCP for Telnet login attempts, change default passwords, and reboot infected devices (Mirai lives in memory), but only reconnect them once the password is changed, or they are reinfected quickly.

911 S5 was a proxy business. According to the Justice Department's May 2024 announcement, its operator spread malware from 2014 to July 2022 through VPN programs he ran, MaskVPN and DewVPN, and through pay-per-install bundles with pirated software. The infected Windows computers were associated with more than 19 million unique IP addresses, 613,841 of them in the United States, and he sold access to them as a residential proxy service, taking in about $99 million from 2018 to July 2022. The operation seized 23 domains and more than 70 servers. If a network like this is pointed at you, a login from a residential IP address in the user's own country does not prove the user typed it.

Emotet and the droppers hit by Operation Endgame worked as delivery services. Europol announced on 27 January 2021 that authorities in eight countries had taken control of Emotet's infrastructure, calling it one of the most significant botnets of the past decade. In May 2024 Operation Endgame went after droppers (IcedID, SystemBC, Pikabot, Smokeloader and Bumblebee), with four arrests, more than 100 servers taken down and 2,000 domains brought under law enforcement control. A dropper exists to install other malware on machines it already controls, so a loader detection on one host raises the next question: what was it there to install?

On your own network, a bot gives itself away through how it talks to its controller. The first sign is beaconing: regular check-ins with the same external address. Operators add jitter, a random variation in the interval, but a 60-second beacon with 20% jitter still produces gaps between 48 and 72 seconds, and the spread stays small next to the average. This Defender XDR query measures that ratio for every device and public IP pair over a day:

DeviceNetworkEvents | where Timestamp > ago(1d) and RemoteIPType == "Public" | project Timestamp, DeviceName, RemoteIP, RemotePort | sort by DeviceName asc, RemoteIP asc, Timestamp asc | extend Gap = datetime_diff("second", Timestamp, prev(Timestamp)), Same = DeviceName == prev(DeviceName) and RemoteIP == prev(RemoteIP) | where Same | summarize Beats = count(), AvgGap = avg(Gap), StdGap = stdev(Gap) by DeviceName, RemoteIP, RemotePort | where Beats > 100 and StdGap < AvgGap * 0.2 | order by Beats desc

Software that polls on purpose (update agents, monitoring, chat clients) will show up too. Add InitiatingProcessFileName to the projection and the by clause to see which process is calling out, and check the destination's reputation and registration date before you allowlist it. A C2 channel that holds one long connection open produces no gaps at all, which is why this is one detection among several.

The second sign is in DNS. With a domain generation algorithm (ATT&CK T1568.002), the malware computes a list of domains and tries them until one resolves to the operator's server, so blocking yesterday's C2 domain achieves nothing. Most of the names were never registered, which produces a burst of NXDOMAIN responses from one client. In Splunk, against CIM-mapped DNS data:

tag=dns reply_code=NXDOMAIN earliest=-24h | bin _time span=10m | stats dc(query) AS nx_names BY _time src | where nx_names > 50 | sort - nx_names

Then look at the names that did resolve for that client in the same ten minutes; one of them is probably the live C2. Misconfigured software and DNS suffix search lists also cause NXDOMAIN bursts, but they repeat the same few names, while DGA output is random strings that rarely repeat.

The third sign is fast flux (T1568.001). One domain resolves to a constantly changing set of IP addresses through round-robin records with short TTLs. In the single-flux variant ATT&CK describes, addresses join and leave the A record list with an average lifespan of about five minutes; double flux applies the same churn to the zone's name server records, putting extra hosts in front of the real C2 server as proxies. Counting distinct answers per name finds candidates:

tag=dns record_type=A earliest=-24h | stats dc(answer) AS distinct_ips dc(src) AS clients BY query | where distinct_ips > 30 | sort - distinct_ips

CDNs and large SaaS platforms rotate addresses as well, so the list needs triage. Flux addresses tend to sit in consumer broadband ranges spread across many networks and countries, while a CDN's come from a handful of its own networks.