C2 (Command and Control)

Why it matters

Almost every meaningful intrusion needs a working C2 channel, which makes it one of the highest-value places to detect an attacker: block or spot the C2 traffic and the attacker loses control of the foothold, regardless of how they got in. It is also one of the fourteen tactics in the ATT&CK Enterprise matrix, with its own set of techniques — DNS tunnelling, web protocols disguised as normal traffic, legitimate cloud services (Slack, Discord, Google Drive, GitHub) used as the relay so the destination looks harmless.

The implant side is usually a commercial or open-source C2 framework — Cobalt Strike, Sliver, Mythic, Havoc — whose default profiles are well fingerprinted, which is why serious actors customise them ("malleable" profiles) to imitate ordinary applications.

How it is usually spotted

Most C2 traffic is designed to look like something ordinary — HTTPS to a plausible-looking domain, DNS queries that resemble CDN traffic. What tends to give it away is pattern, not payload:

• Beaconing: check-ins at a regular interval (every 60 s, every 5 min) with small, similar-sized requests, often with a little random "jitter" added precisely to defeat naive interval detection. Long-tail analysis of connections per host per destination finds it.
• Destination reputation and age: a domain registered days ago, a bare IP over TLS, an unusual ASN for the organisation, a certificate with default or self-signed fields.
• Protocol anomalies: DNS queries with long, high-entropy subdomains (tunnelling), HTTP with a mismatched or rare user agent, TLS fingerprints (JA3/JA4) that match a known framework.
• Volume asymmetry: a workstation that uploads far more than it downloads to one host is exfiltrating over the C2 channel (T1041).

Common misreadings

• Blocking the domain is not the end. Frameworks fall back to secondary channels; treat a blocked C2 as the start of containment, not proof of eradication.
• Legitimate software beacons too. Update checkers, telemetry and chat clients all poll on intervals. The signal is beaconing to an unknown destination from a host that should not need it.
• Do not interact with it. Browsing to a suspected C2 URL from a corporate machine tells the operator you found them and hands them another IP.

Related terms

• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".
• IOC — An IOC is a piece of forensic evidence — a file hash, an IP address, a domain, a registry key, a mutex — whose presence on a system or in traffic indicates that a known intrusion has occurred.
• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• LOLBin — A LOLBin (Living Off the Land Binary) is a legitimate, pre-installed system tool — certutil, mshta, rundll32 — that an attacker repurposes to download, execute or hide malicious activity, so nothing "new" ever touches disk.