# How do you detect C2 beaconing?

Look for one host connecting to the same external destination at near-regular intervals, around the clock, with small messages of similar size. The pattern shows in flow data and firewall logs, and in encrypted traffic too, because timing, volume and destination are not encrypted.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/how-do-you-detect-c2-beaconing

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Can you detect lateral movement in encrypted traffic?](https://netsenx.com/en/faq/can-you-detect-lateral-movement-in-encrypted-traffic)
- [Which MITRE ATT&CK techniques can network detection see?](https://netsenx.com/en/faq/which-mitre-att-ck-techniques-can-network-detection-see)
- [What is C2 beaconing?](https://netsenx.com/en/faq/what-is-c2-beaconing)
- [What is data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-data-exfiltration)
- [What does living off the land mean?](https://netsenx.com/en/faq/what-is-living-off-the-land)