Muhammad Sohail

This study shows that without explicit network-layer indication, MCP traffic structurally and temporally resembles Command and Control beaconing behavior, specifically the polling architectures used by advanced persistent threats like Cobalt Strike, and proposes an agent-native network indication standard including Agent-Native ALPN and standardized out-of-band headers.