Command and control, or C2, is the channel an attacker uses to communicate with systems they have compromised, to send instructions and receive results. MITRE ATT&CK defines it as techniques adversaries use to communicate with systems under their control within a victim network. Good C2 looks like normal traffic.
How does MITRE describe it?
In ATT&CK, Command and Control is tactic TA0011. The page says adversaries "commonly attempt to mimic normal, expected traffic to avoid detection" and that stealth varies with the victim's network structure and defenses. The tactic lists 18 techniques in the current version, from application layer protocols to proxies and encrypted channels.
The first technique listed, T1071, is Application Layer Protocol. The idea: embed commands and results inside web, mail or DNS traffic that is already allowed through the firewall. A compromised host that makes an HTTPS request every few minutes can look like any software checking for updates.
Why is it hard to catch?
Blocking known bad addresses helps only against known infrastructure. Encrypted traffic hides content. The attacker picks ports and protocols your network permits. Many of these connections start from inside, which most firewalls allow.
That is why detection leans on behaviour rather than content.
What signals are worth watching?
Regular timing. Software that calls out at fixed intervals, with small jitter, can mark an implant checking in. Legitimate tools do this too, so you compare against known software.
Odd destinations. A server that never browses the internet suddenly connecting to a newly seen host.
Unusual volume. Many small requests with similar sizes, or a sudden large upload.
Protocol misuse. DNS queries with long, random-looking names, or a web client with an unusual user agent.
Process context. Which program made the connection? A document viewer talking to a remote server is worth a question.
What does a constructed example look like?
A build server in a small company makes no outbound connections except to its package mirror. One morning the proxy log shows it contacting an unfamiliar domain every 300 seconds, with a near-identical request size each time. The domain was registered nine days earlier. That pattern, fixed rhythm, new destination and a host with a narrow job, is a lead worth an analyst's hour.
What are the common channel styles?
Attackers pick a channel to blend in. Some use ordinary web requests to a server they control. Some hide in DNS lookups, which almost every network allows. Some use legitimate cloud services as a relay, so the traffic goes to a well-known domain. Others use peer-to-peer links between infected machines, so only one needs to reach the outside. The ATT&CK tactic page lists techniques for each style, including proxies and encrypted channels. Learn the ones that fit your environment, and test whether your logs would show them.
Does blocking the channel end the attack?
Cutting the channel stops live control, but it does not remove the foothold. Malware can wait and retry through a backup channel, or carry out pre-set tasks without instructions. After you block a C2 destination, assume the host is still compromised. Isolate it, find how it got in, and look for other hosts that talked to the same destination. Searching your logs for that destination across all machines, going back weeks, often turns up more than one.
How to check or apply this
- Decide which hosts should have outbound access and to what. Servers with narrow jobs should have narrow egress.
- Send proxy, DNS and firewall logs to one place, and keep them long enough to look back.
- Alert on first-seen destinations from sensitive hosts.
- Hunt for beaconing: group connections by source and destination and look for regular intervals.
- Map your detections to ATT&CK TA0011 techniques and note the gaps.
- When you find C2, isolate the host, preserve evidence, then follow your incident plan. NIST SP 800-61 Rev. 3 frames incident response within the Cybersecurity Framework.
- Keep build and package dependencies under watch. Compromised software in your supply chain can carry its own callback.
Quick check
Is C2 the same as malware?
No. Malware is the code running on the victim. C2 is the communication path that lets the attacker direct it.
Does encrypted traffic mean you cannot detect C2?
No. You lose content, but timing, destination, volume and process context still give signals.
Sources
Last reviewed: 18 October 2026.
