Beacons
The periodic check-ins a compromised host makes to an attacker's command-and-control server to receive instructions. Their regular, often-disguised pattern is a key signal defenders hunt for to find hidden footholds.
Concept Neighborhood
Start here
Flow Data
The most substantial related concept here, covered by 6 lessons.
C2 Communication Detection
Detections that identify command-and-control traffic, the channel a compromised host uses to receive attacker instructions, by spotting patterns like regular beaconing, suspicious destinations, or anomalous protocols.
5
lessons
C2 Hunts
Threat hunts specifically aimed at finding command-and-control activity that detections missed, by searching telemetry for beaconing patterns, rare external connections, and other signs of an attacker's hidden communication channel.
1
lesson
Related Lessons
1 lesson covers this conceptSign in to open lesson content directly.