Beaconing refers to the process of an infected device phoning home to an attacker’s C2 infrastructure to check for instructions or additional payloads, often at regular intervals. To avoid detection, some types of malware beacon at random intervals, or may lie dormant for a period of time before phoning home.