What is command and control?
Command and control, usually shortened to C2 (and sometimes C&C), is the communication channel between an attacker and the systems they have compromised. Malware on an infected host uses it to receive instructions, download additional tools, report results and send stolen data out. The servers and domains the attacker runs for this purpose are called C2 infrastructure. Without a working C2 channel, most malware cannot be directed after it lands, which is why finding and cutting C2 is a large part of detecting and containing an intrusion.
How C2 works
Most C2 is outbound: the compromised host reaches out to the attacker's server rather than waiting for an inbound connection, because firewalls usually allow outbound traffic. The host checks in at intervals, a pattern called beaconing, and often adds random variation (jitter) to the timing to look less mechanical. To blend in, C2 commonly travels over:
- HTTPS on port 443, where it resembles ordinary web browsing
- DNS, with data carried in queries and responses, known as DNS tunneling
- Legitimate cloud services, such as file-sharing, collaboration or social media platforms
Some malware uses domain generation algorithms (DGAs), which produce many random-looking candidate domains each day so blocking one name is not enough. Fast flux, where one domain resolves to a rapidly changing set of IP addresses, serves the same purpose. Botnets may use central servers or a peer-to-peer design with no single server to take down.
A C2 beacon in the logs
A proxy log shows a workstation contacting the same external address every 60 seconds, around the clock, with nearly identical request and response sizes each time. The domain was registered three days ago and has no business purpose. Normal browsing is bursty and varied; a steady heartbeat to a new domain is the signature of beaconing.
How to detect and block C2
- Egress filtering: allow outbound traffic only through approved paths, such as a web proxy, and block direct outbound connections from servers.
- DNS filtering and monitoring: block known malicious and newly registered domains, watch for DGA-style names and unusually long or frequent queries, and sinkhole known C2 domains.
- TLS inspection at the proxy where policy allows, so encrypted C2 can be examined.
- Network flow analysis to find periodic beacons and unusual destinations.
- Threat intelligence feeds loaded into the firewall, proxy, SIEM and EDR.
During incident response, blocking C2 addresses cuts the attacker off, but it should be coordinated with isolating hosts and removing persistence, or the attacker may switch to a backup channel.
C2 in attack frameworks
Command and control is a named stage in the Lockheed Martin Cyber Kill Chain, after installation and before actions on objectives, and a tactic in MITRE ATT&CK. Both frameworks treat it as the point where a single infection becomes an operation the attacker can steer.
Command and control on the CompTIA Security+ exam
C2 appears throughout SY0-801 objective 2.5 as an indicator of malicious activity. Scenario wording that points to it includes beaconing at fixed intervals, connections to newly registered or random-looking domains, high volumes of DNS queries to one domain and an infected host talking to a known malicious address. Related answers include botnet (many hosts under one C2), RAT (interactive C2 on one host), DNS tunneling (C2 carried over DNS) and data exfiltration (data leaving over the channel). For defense, look for egress filtering, DNS filtering and TLS inspection.