An EDR alert shows a signed Windows process making outbound TCP connections to the same external IPv4 address every 300 seconds, with low variance, during and outside business hours. The payload size is small, and the process has no user-facing function. Which indicator most strongly suggests malware command and control?

Malware command and control often manifests as periodic outbound connections from a compromised host to a persistent external destination, because the implant must check in for tasking and return results. Low jitter, small payloads, and activity outside business hours strengthen the indicator when the process lacks a normal user-facing role. Analysts correlate destination stability, interval regularity, and process context to distinguish C2 from benign polling. A large one-time transfer to an internal file share is more consistent with exfiltration or an unusual administrative access pattern, not beaconing, because it lacks recurring external check-ins. Repeated failed logins from a public IP against multiple accounts describe credential authentication attacks, which target identity systems rather than establishing covert remote control. An unsigned script downloading from a newly registered domain indicates suspicious execution or initial payload retrieval, but it does not by itself demonstrate the recurring tasking channel described in the telemetry. Exam caveat: CompTIA often asks you to select the indicator that best matches the observed periodicity and destination, not the most severe-looking malicious event. Operational check: Pivot on the destination IP in proxy, firewall, and EDR logs to confirm connection timing, jitter, and process lineage before escalation.