A technician discovers that a workstation has been connecting to an external IP address every 15 minutes, sending small packets of data. No known application is responsible. What type of malware behavior does this MOST likely indicate?

Question

Accepted Answer

B. Command and Control (C2) beaconing. Command and Control (C2) beaconing is a behavior where malware on an infected system periodically contacts a remote C2 server to receive instructions, report status, or exfiltrate data. The regular interval and small packet size are characteristic of C2 beaconing rather than ransomware payload delivery (which is typically a one-time large transfer), adware (browser-based), or keylogging (local capture).

A technician discovers that a workstation has been connecting to an external IP address every 15 minutes, sending small packets of data. No known application is responsible. What type of malware behavior does this MOST likely indicate?

Related Questions

Discussion