Clockwork C2: Detect the Beacon by Its Rhythm, Not Its Volume

A connection log (/var/log/conn.log) shows this box reaching out to an external host on a steady, clockwork interval — the hallmark of a C2 beacon checking in. The catch: a CDN host receives just as MANY connections, only bursty and irregular like real user traffic. A volume-only rule ('many connections to one host') flags both — a false positive. The beacon's real signal is REGULARITY: near-constant time between connections.

1. Identify the beacon's destination IP and record it in /root/case/c2_ip.txt.

2. Write a detector at /root/detect.sh that reads the conn log on stdin and prints the beaconing destination IP(s). Grading runs bash /root/detect.sh < /var/log/conn.log. Grading also feeds it a second, unseen log the same way, so it must work from what it reads on stdin, not from a hardcoded file path or answer.

3. Tune on TIMING, not count: per destination, look at the gaps between successive timestamps. The beacon's gaps barely vary (~60s); the CDN's are all over the place. MITRE ATT&CK: T1071 / T1571.