Malware on a clerk workstation talks to a rare external IP on a high port every 60 seconds. What stage is this pattern?
Select an answer to reveal the explanation.
Short Explanation
Every minute, that clerk PC whispers to a weird high-port IP. That heartbeat is C2, the remote control channel—not the phish that dropped the file and not encryption yet. Delivery already happened; this is the callback.
Full Explanation
Periodic egress to a rare external IP and high port is classic command-and-control beaconing, a post-delivery stage. Phishing is the earlier introduction path; ransomware would show encryption and extortion; DoS would target availability of a service. Analysts must separate C2 from the initial vector.