Attacks and malware
What is Beaconing?
Regular check-ins from implanted malware to its command and control server, often at a fixed interval, asking whether there are new instructions.
Beaconing is the habit of implanted malware to contact its command and control server at regular intervals to ask for new tasks. Most implants add random variation, called jitter, to the interval to look less mechanical.
Even when the traffic is encrypted, the timing pattern can give it away. Hunters look for hosts that contact the same destination at steady intervals over long periods, especially to rare or newly registered domains.