Detect SLIGHTPULSE by hunting for suspicious execution and sustained beaconing from endpoints that should not communicate externally. Review process lineage, service creation, scheduled tasks, and registry or file changes that indicate persistence. Pair these findings with proxy and DNS analysis, and treat any workstation that starts regular low-volume outbound traffic as suspect.
What SLIGHTPULSE detection should look for first
Start with the behaviour that most reliably separates a living infection from ordinary workstation noise. Suspicious execution, repeated outbound beacons, and process trees that do not match the host’s role are the core signals. For a broad malware primer and evasion patterns, use the Malware Guide as a reference point for how loaders, RAT-like tooling, and evasive tradecraft surface in telemetry.
Low-volume outbound traffic matters because many operators keep malware quiet while it establishes persistence or awaits tasking. A single connection is rarely enough to prove compromise, but regular timing, unusual destinations, and processes that should not reach the internet at all are strong indicators when they line up with host activity.
Host artefacts that make beaconing credible
Endpoint detection becomes much more useful when network activity is tied to concrete host changes. Review parent-child process chains, new services, scheduled tasks, and registry or file modifications that persist across reboots. Those artefacts show that the traffic is not just transient user activity, but part of a repeatable execution path.
If the workstation is not expected to run servers, automation, or remote admin tooling, a newly created service or task deserves immediate scrutiny. The same applies to startup locations, unusual script hosts, renamed binaries in writable directories, and execution from user profile paths. These are the kinds of breadcrumbs that help distinguish initial execution from follow-on persistence.
When endpoint evidence is weak, correlate the host timeline with proxy logs, DNS queries, and any unusual name resolution behaviour. That cross-check often reveals whether the beacon is really periodic command-and-control traffic, a false positive from a legitimate updater, or a one-off outbound connection that has no follow-up.
Turning detections into containment decisions
Once the signals align, the practical question is whether the host is merely suspicious or already operationally compromised. A workstation that begins steady, low-volume egress from a process it should not be running should be treated as a containment candidate, especially if the same host shows persistence or tampering with normal startup paths. If the workstation also participates in sensitive admin activity, the case moves from endpoint hygiene to possible credential exposure.
That is why detection should not stop at process names. Teams need the full chain, from first execution through persistence and external communication, because malware often changes its surface artefacts while keeping the same communication pattern. Even when the payload is unknown, the combination of repeatable beaconing and host modification is enough to justify isolation and deeper forensic review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-13 — Data Protection | Malware detection relies on monitoring suspicious endpoint and network activity. |
| CIS-10 — Malware Defenses | The question is explicitly about detecting malware on endpoints and in network telemetry. | |
| Recommendation — Monitor endpoints and network traffic for malware-like execution and beaconing patterns. Correlate malware-defense alerts with host and network telemetry to confirm compromise. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Beaconing, odd process lineage, and persistence artefacts are anomaly signals to detect. |
| Recommendation — Centralize endpoint and network telemetry to detect suspicious execution and beaconing. | ||
| MITRE ATT&CK | T1053 — Scheduled Task/Job | Scheduled-task persistence is a core host artefact in the detection pattern described. |
| T1547 — Boot or Logon Autostart Execution | Registry and startup-path changes are common persistence mechanisms for malware. | |
| Recommendation — Hunt for scheduled-task persistence when a host shows suspicious outbound beaconing. Inspect autostart locations and registry changes when malware persistence is suspected. | ||
Practitioner Guidance
What to prioritise: Focus on hosts that combine suspicious execution with periodic outbound traffic, then enrich those alerts with service creation, scheduled task creation, and registry or file changes. The strongest cases are the ones where network, process, and persistence evidence all point to the same machine.
What to verify: Confirm whether the beaconing process is legitimate for that workstation role, whether the destination is expected, and whether the timing persists across restarts. Also verify whether the same endpoint shows evidence of tampering with startup paths or administrative tooling, because that shifts the response from monitoring to containment.
Decision rule: If the host shows regular low-volume outbound traffic plus any persistence artefact, treat it as potentially compromised even before you can identify the malware family. If the host is a privileged or high-value system, escalate faster and preserve evidence before remediation alters the artefacts you need for scoping.
Practitioner takeaway: The most dependable detection pattern is not a single IOC, it is a corroborated story of execution, persistence, and repeatable external communication.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org