A Cobalt Strike beacon was detected on the network, originating from an external IP address known for malicious activity. The beacon was executed on a compromised internal machine, indicating potential ransomware deployment.