Detect STEADYPULSE by looking for suspicious execution patterns and sustained communication with external infrastructure. Monitor for unexpected autoruns, script abuse, and process activity that does not fit the host’s normal role. Combine EDR, DNS, and proxy data so you can link the local compromise to network beacons or command-and-control activity.
What detection should focus on first?
STEADYPULSE detection works best when you look for a cluster of behaviours, not a single alert. The most useful starting point is unusual process creation, unexpected autoruns, script execution that does not fit the host role, and sustained outbound communication to infrastructure the system should not normally contact.
A narrow indicator can be noisy, but a behavioural pattern is harder to hide. A host that repeatedly launches child processes, spawns scripts from user-writable paths, or reconnects on a steady cadence to external endpoints deserves closer inspection than a one-off alert with no supporting activity.
When you have EDR telemetry, anchor the review on process tree anomalies and persistence points. When you have network telemetry, look for recurring DNS lookups, proxy connections, and beacon-like timing that line up with the local execution pattern. The strength of the detection is in correlation across host and network evidence, not in any single event.
How do analysts separate compromise from benign automation?
Normal automation usually has a stable purpose, predictable parent-child process relationships, and known destinations. Suspicious activity stands out when the execution chain is inconsistent with the asset’s role, occurs at unusual times, uses uncommon interpreters or living-off-the-land binaries, or writes autoruns and scripts where the host would not normally need them.
A practical triage question is whether the behaviour is explainable by approved tooling. If the same pattern appears across multiple hosts with the same job function, compare the process lineage, command-line arguments, and destination domains before deciding it is benign. If it is isolated to one system and paired with persistence or outbound beacons, treat it as higher confidence.
For host-role validation, a mail server, workstation, developer endpoint, and management jump host should not all emit the same execution profile. The more the activity departs from expected administrative tooling or scheduled jobs, the more likely it is to represent compromise rather than routine maintenance.
What telemetry gives the clearest signal?
The highest-value view is a joined one. EDR shows how code ran locally, DNS can reveal the first stage of external reach-out, and proxy logs can show repeat contact with command-and-control infrastructure or hosted payload locations. Any one source may be incomplete, but together they often show the path from initial execution to sustained communication.
Build the review around time alignment. If a suspicious script launches, followed by repetitive DNS resolution and then outbound proxy sessions on a regular interval, that sequence is more informative than reviewing each event separately. Correlation also helps identify whether the activity is truly persistent, which is often the difference between a transient anomaly and an active foothold.
For teams that need a broader detection baseline, MITRE ATT&CK Enterprise Matrix is useful for mapping the observed behaviour to common adversary tactics, while NIST Cybersecurity Framework 2.0 provides a good organising model for detection and response activities.
Risk and Threat Considerations
STEADYPULSE-style activity is dangerous because persistence and beaconing let an intruder stay quiet while maintaining access. The main risk is not a single malicious event, but a stable foothold that blends into routine host activity and keeps re-establishing contact with external infrastructure.
Failure mechanism: Attackers abuse script execution, autoruns, and ordinary system processes to hide execution, then use periodic outbound traffic to sustain command-and-control and reduce the chance of immediate detection.
Impact: Delayed discovery increases the chance of follow-on credential theft, lateral movement, payload delivery, and data access before defenders notice the host is compromised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1053 — Scheduled Task/Job | STEADYPULSE detection looks for autoruns and persistent execution patterns. |
| T1059 — Command and Scripting Interpreter | Script abuse is central to the execution patterns described in the answer. | |
| Recommendation — Map autoruns and scheduled execution to persistence techniques and hunt for repeated re-entry. Inspect script interpreters and command lines for unusual execution chains and obfuscation. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | The question is about detecting malicious activity through telemetry correlation. |
| DE.AE-02 — Anomalous Events | Suspicious process activity and outbound beacons are anomalous events to investigate. | |
| Recommendation — Continuously monitor endpoint and network telemetry for anomalous execution and beaconing. Triage event clusters that deviate from the host’s normal role and usage pattern. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on analysing EDR, DNS, and proxy records together. |
| Recommendation — Review correlated logs to identify execution, persistence, and outbound command-and-control patterns. | ||
Practitioner Guidance
What to prioritise: Focus first on hosts that combine persistence with recurring external communications, because that pairing is more actionable than either signal alone. Validate whether the destination domains, timing, and parent-child process chains match the asset’s approved role.
What to verify: Confirm that detections are backed by host telemetry and network telemetry together. If you only have endpoint visibility, you may miss the beaconing pattern; if you only have network visibility, you may miss the local persistence mechanism.
Practitioner takeaway: The best detection strategy is correlation, not isolated indicators, because persistent malware is most visible when local execution, autoruns, and outbound communication are evaluated as one chain.