Beaconing

Beaconing: Regular communication between a compromised system and a command-and-control infrastructure. Defense requires robust preventionPreventionMeasures intended to stop security incidents or attacks before they occur., meaningful loggingLoggingThe recording of security-relevant events so activity can be monitored, investigated, and audited., timely detectionDetectionThe capability to identify suspicious activity, attacks, or policy violations in time., and clearly defined response measures.

How it works and where it fits

Beaconing connects data sources to detection or assessment logic. Raw records become security-relevant only when timing, identity, system context, and expected behavior are considered. Rules, correlations, statistical models, and analyst decisions may work together; no single method reliably covers every attack pattern.

Practical security relevance

Operational quality is reflected in coverage, data completeness, detection time, and false-alert workload. Data sources need owners, time synchronization, retention, and quality controls. Detections should be tested, versioned, and improved using real incidents. Every meaningful alert also requires triage guidance, escalation, and possible response actions.

Related concepts

• Command and ControlCommand and ControlCommunication infrastructure used by attackers to control compromised systems.: Communication infrastructure used by attackers to control compromised systems.
• Incident ResponseIncident ResponseA structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.: A structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.
• Incident TriageIncident TriageRapid classification and prioritization of a potential security incident.: Rapid classification and prioritization of a potential security incident.
• MalwareMalwareUmbrella term for software with malicious or unwanted functionality.: Umbrella term for software with malicious or unwanted functionality.