C2 beaconing
Named by 3 kept items in this workspace.
Search every workspace for C2 beaconing. It matches the name as written, so it can find other things that share it.
The items that name it 3
POSTs platform label to http://193.70.34.101:20099/vote as an install/host selector
C2 beacon event streaming from Cobalt Strike/Havoc/Sliver
Malicious Chrome extension beacons to C2 server at 172.86.105[.]237:5000 every five seconds for tasking (Case study 4).
All techniques in this workspace.