C2 beacon
Implant on compromised host that "calls home" to C2 server periodically. Cobalt Strike Beacon is the iconic implementation. Sleep + jitter (random delay) to avoid network anomaly detection.
Sleep 60 sec + 30% jitter = between 42-78 sec between check-ins. Malleable C2 profile: adapt beacon traffic to "looks like" Office365, Slack, Bing traffic. Beacon features: filesystem access, process injection, lateral movement, keylogging, screenshot, credential theft. Detection: time-series analysis of outbound connections with abnormal regularity (Microsoft Defender for Endpoint, CrowdStrike Falcon). Memory-only beacons (no disk IO) make forensic analysis hard. Modern beacons use HTTPS + custom certificate pinning + domain fronting.