A Zeek analyst notices that a connection log shows a large number of sessions to a single external IP with very short durations and fixed byte counts. This pattern is most consistent with which type of activity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because periodic short sessions with consistent byte counts to a single external IP is a classic beaconing pattern used by malware for C2 communication. A is wrong because TLS failures produce variable patterns and typically resolve or stop, not repeat at fixed intervals.
Full explanation below image
Full Explanation
B is correct because periodic short sessions with consistent byte counts to a single external IP is a classic beaconing pattern used by malware for C2 communication. A is wrong because TLS failures produce variable patterns and typically resolve or stop, not repeat at fixed intervals. C is wrong because CDN traffic shows connections to many IPs with varying session sizes. D is wrong because SMTP delivery shows connections to many recipient mail servers, not repeated connections to a single IP.