An organization's security team detects unusual outbound traffic from a server to an unfamiliar external IP address at regular intervals. Investigation reveals no known malware on the system. Which threat scenario BEST describes this behavior?

Question

Accepted Answer

B. Command and control (C2) beaconing from an advanced persistent threat. Regular periodic outbound connections to an external IP are characteristic of command and control (C2) beaconing, where compromised hosts check in with attacker infrastructure at scheduled intervals. This pattern is associated with Advanced Persistent Threats (APTs) that maintain stealthy long-term access. The absence of detected malware may indicate a fileless or living-off-the-land threat.

An organization's security team detects unusual outbound traffic from a server to an unfamiliar external IP address at regular intervals. Investigation reveals no known malware on the system. Which threat scenario BEST describes this behavior?

Related Questions

Discussion