Malware on a clerk workstation talks to a rare external IP on a high port every 60 seconds. What stage is this pattern?
Select an answer to reveal the explanation.
Short Explanation
Every minute, that clerk PC whispers to a weird high-port IP. That heartbeat is C2, the remote control channel—not the phish that dropped the file and not encryption yet. Delivery already happened; this is the callback.
Full Explanation
Malware on a clerk workstation that talks to a rare external IP on a high port every 60 seconds is command-and-control beaconing after delivery. The heartbeat is the remote control channel—the walkie-talkie the attacker uses for check-ins and potential tasking—not the initial phish and not mass encryption yet. Civic SOCs should stage the intrusion correctly on the timeline: delivery already happened; this periodic rare-destination pattern is C2 keep-alive behavior that belongs in threat intel and host isolation workflows.
Calling it the initial phishing delivery that first placed the malware fails by concept: periodic beaconing is post-delivery callback behavior, not the original lure event. Calling it mass encryption plus a ransom note fails by concept: no encryptor activity or ransom note is described in the stem. Calling it a single-source denial of service against the clerk inbox fails by concept: regular high-port callbacks to a rare IP are not a DoS against mail services.
Exam caveat: Periodic callbacks to rare external infrastructure approximate command-and-control beaconing after implantation.
Operational check: Isolate the clerk host, capture beacon destinations into Enterprise Security threat intel and investigations, hunt other hosts with the same rare IP and port cadence, and block or sinkhole the C2 while preserving forensic evidence.