What is C2 beaconing?

Command-and-control (C2C2: command and control. The channel an attacker's software uses to receive instructions from the attacker's server.) beaconing is malware checking in with the attacker's server at regular intervals to ask for instructions. On the network it looks like small connections to the same destination every few minutes, day and night, often with a little random jitter added so that it looks less regular. Because it is a pattern in time, it stays visible when the traffic is encrypted. Legitimate software beacons too, such as update agents, monitoring tools and chat applications, so what matters is a new destination, a device that has no reason to need it, or a rhythm that never stops, even at night. NetSenX flags beaconing on every plan, Free included, and explains on the alert which features of the timing and destination drove it.

← All 69 questions on Attack techniques explainedAll topics