How do you detect C2 beaconing?

Look for one host connecting to the same external destination at near-regular intervals, around the clock, with small messages of similar size. The pattern shows in flow data and firewall logs, and in encrypted traffic too, because timing, volume and destination are not encrypted.

This answer also appears, with more context, here: Lateral movement and C2 beaconing

← All 69 questions on Attack techniques explainedAll topics