Hack the Route Start free Open app Detection and response
Beaconing
A compromised host repeatedly contacting an outside controller to fetch commands, on a regular rhythm.
After it lands, an implant beacons: it reaches out to its command-and-control (C2) server every few seconds or minutes to ask for tasking, rather than waiting to be contacted, which lets it work from behind NAT and firewalls. The regularity is the tell — connections to one outside address on a steady cadence stand out in a capture or a flow log even when the payload is encrypted. Cut the channel to contain, and the C2 address becomes an indicator.