Command and control
noun · also C2, C&C · MITRE ATT&CK TA0011
The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.
Once malware is running inside a network, the attacker needs a way to tell it what to do. Command and control (C2) is that channel. The implant on the victim's machine periodically contacts the attacker's server, a pattern called beaconing, asks whether there are new instructions, and sends back results.
To avoid detection, C2 traffic usually imitates normal activity: HTTPS to ordinary-looking domains, requests routed through legitimate cloud services, or data hidden in DNS queries. Commercial red team frameworks such as Cobalt Strike, and their cracked copies, are widely used by criminals for this purpose. MITRE ATT&CK treats C2 as its own tactic (TA0011).
Example
A compromised workstation connects to the same newly registered domain every 60 seconds, with a little random variation, sending small HTTPS requests and receiving small responses, even at night when the user is logged out. That regular rhythm is typical of an implant checking in with its C2 server.
Why it matters for a SOC analyst
Cutting the C2 channel takes away the attacker's hands on the keyboard, which is why blocking the domain or IP is often one of the first containment steps. To find C2, look for regular connections to rare destinations, newly registered domains, unusual volumes of DNS traffic and processes that should not be talking to the internet at all.
Related terms
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.
- Botnet
A network of compromised devices controlled remotely by an attacker and used together for spam, DDoS attacks, credential attacks or proxying traffic.
- Trojan
Malware disguised as legitimate software, such as a cracked app, a fake update or an invoice, that the victim installs themselves.
- Cyber kill chain
Lockheed Martin's seven-stage model of an intrusion, from reconnaissance to actions on objectives, used to find where an attack can be stopped.