Beaconing
Regular callbacks from a host that should be quieter. Interval plus jitter, not a perfect metronome.
Beaconing is periodic outbound contact, often command-and-control checking in. The interval can be minutes or hours, with jitter so it does not look like a clock. HTTPS to a rare domain, DNS on a timer, or a session that never quite dies.
NetFlow and proxy logs catch rhythm better than a single packet. Baseline what regular already is: updates, device management, monitoring agents. Then the new regular stands out.
See also: Command and control, NetFlow, Network detection and response, Packet capture.