What Is Command and Control (C2)?

A compromised laptop makes a quiet HTTPS request to a domain that looks like a content-delivery network, roughly once a minute, and gets back a few bytes in reply. Most of the time the response is empty. Occasionally it is larger, and right after, the laptop runs a new command, enumerates a file share, or sends a burst of data out. Nothing about any single request looks alarming. Strung together, the pattern is unmistakable: the malware is phoning home, asking its operator "any orders?" and acting on the answers. That conversation is command and control, and it is the line that connects an attacker sitting anywhere in the world to a machine inside your network.

Command and control, written C2 or C&C, is how an attacker communicates with and directs the systems they have compromised. After malware lands on a host, it needs a way to receive instructions and return results; the C2 channel is that link. It is the control plane of an intrusion, the difference between an inert piece of malware and a live, remotely operated foothold.

This guide covers what command and control is, why it is so central to an attack, how the channel actually works, the common techniques and channels mapped to MITRE ATT&CK, the frameworks attackers use, and how defenders detect and cut the connection. It is written for blue teamers who hunt the traffic that gives an attacker their remote hand.

What is command and control?

Command and control is the set of techniques an attacker uses to communicate with compromised systems in order to control them. MITRE ATT&CK catalogs it as a dedicated tactic, Command and Control (TA0011), defined plainly: the adversary is trying to communicate with compromised systems to control them. The compromised host runs an implant or beacon; the attacker runs a C2 server; the channel between them carries commands one way and stolen data and status the other.

The defining feature of modern control channels is the callback model. Rather than the attacker connecting inward to the victim, which an inbound firewall would block, the implant on the victim reaches outward to the server. Outbound connections, especially over web protocols, are routinely allowed, so the malware initiates the conversation and the firewall waves it through as ordinary egress traffic. The attacker never has to knock on the front door; the malware opens a line from the inside.

Once that line exists, the attacker has interactive control. They can run commands, deploy more tooling, pivot to other systems, and pull data out, all through the same channel. This is why the channel is often described as the heartbeat of an intrusion: as long as it beats, the attacker is in the room.

Why command and control matters

Command and control sits at the center of nearly every serious intrusion, which makes it one of the most valuable things a defender can find and cut.

It is the attacker's remote hand. Almost everything an attacker does after the initial foothold, lateral movement, credential theft, deploying ransomware, exfiltration, is orchestrated through this channel. Without it, the malware on the host is a loaded gun with no one holding it.

Cutting it ends the interactive attack. Identify and block the channel and you sever the attacker's control. They may have persistence that re-establishes a connection, which is why eviction is hard, but breaking the link stops the live, hands-on-keyboard activity in its tracks. Disrupting it is one of the highest-impact actions in incident response.

It is detectable. Unlike code that runs and vanishes, the channel has to communicate repeatedly over the network, and that communication leaves a pattern. The need to phone home is the attacker's structural weakness: it is recurring, it crosses the network where you can watch it, and it is the trail that leads back to compromised hosts you did not know about.

That last point is the defender's opening. The attacker's requirement for control is also their exposure, and hunting this traffic is one of the most productive ways to find an active intrusion.

How a C2 channel works

The mechanics are consistent across most malware families, even as the disguises vary.

1. The implant checks in. The malware on the compromised host (the implant, agent, or beacon) reaches out to the server on a schedule to announce it is alive and ask for instructions. This recurring check-in is called beaconing.
2. The operator sends tasks. The server, controlled by the attacker, replies with commands: run this, download that, find the file server, start exfiltrating. If there is nothing to do, the reply is empty and the implant goes back to sleep until the next beacon.
3. Results come back. The implant executes the task and returns output, stolen data, or status over the same channel, then resumes beaconing.

Beaconing is the rhythm of C2, and attackers tune it deliberately. A beacon that calls home every second is responsive but noisy and easy to spot; one that calls every few hours is stealthy but slow to control. To avoid the tell-tale signature of perfectly regular check-ins, malware adds jitter, randomizing the interval so the timing looks less mechanical. The art of evasion is making this recurring conversation blend into normal traffic; the art of detection is finding the rhythm underneath the disguise.

Common C2 techniques and channels

Attackers route the channel through whatever traffic blends in best on the target network. Each approach maps to a MITRE ATT&CK technique.

Web protocols are the workhorse. Most traffic of this kind rides HTTP or HTTPS because it is ubiquitous and almost always allowed outbound. With HTTPS, the payload is also encrypted, so a network inspector sees a TLS connection to some domain but not the commands inside (T1071.001, T1573).

DNS is the sneaky favorite. DNS is allowed almost everywhere and often loosely monitored, so attackers tunnel commands inside DNS queries and responses, encoding commands and exfiltrated data into hostnames and records (T1071.004). It is slow but remarkably hard to block outright, because no one can turn off DNS.

Legitimate services as relays. Rather than run their own server, attackers use trusted platforms, cloud storage, social media, code repositories, paste sites, as a dead drop the implant reads from and writes to (T1102). The traffic goes to a reputable domain, which defeats simple reputation blocking.

Resilience by design. Capable malware uses fallback channels (T1008) and protocol tunneling (T1572) so that blocking one route does not cut control, and may rotate through many domains to stay ahead of blocklists.

C2 frameworks

Attackers rarely build one from scratch. They use frameworks, ready-made implant-and-server toolkits that handle beaconing, tasking, encryption, and evasion. Cobalt Strike is the best known: a commercial red-team tool whose cracked versions are abused in countless real intrusions, including ransomware. Open-source frameworks like Sliver and Mythic provide similar capabilities and have seen growing adversary use.

The double-edged nature matters for defenders. These are legitimate penetration-testing and red-team tools, which is exactly why they are effective for attackers and why their traffic can be hard to distinguish from sanctioned testing. The upside is that because the frameworks are well studied, their default beaconing patterns, payload structures, and network fingerprints are documented, and detection content exists for the common ones. Knowing the frameworks is part of knowing what to hunt for.

C2 also underpins specific threat categories. A botnet is C2 at scale, one operator controlling thousands of compromised devices through a shared channel. Advanced persistent threats rely on stealthy, resilient channels to maintain long-term access. In each case the channel is the spine that holds the operation together.

How to detect command and control

Because the channel has to communicate over the network repeatedly, detection focuses on the traffic and its patterns rather than on a file.

• Hunt for beaconing. The recurring, regular check-in is C2's signature. Analyzing connection logs for hosts that contact the same destination at consistent intervals, even with jitter, surfaces beacons that individual requests hide. This is one of the highest-yield network hunts.
• Watch DNS closely. Unusually long or high-entropy hostnames, a single host making an abnormal volume of DNS queries, and lookups to newly registered or rare domains are classic signs of DNS tunneling. DNS is too often a blind spot; making it visible catches a favored channel.
• Inspect TLS metadata. Even without decrypting, the destination, certificate details, and TLS fingerprints (such as JA3) of a connection can flag known C2 frameworks and suspicious endpoints. Behavior and metadata work where payload inspection cannot.
• Apply threat intelligence. Known C2 domains, IPs, and infrastructure are published constantly; matching outbound traffic against current intel turns those indicators of compromise into detections. The catch is that infrastructure rotates, so intel must be fresh.
• Use network detection. Dedicated network traffic analysis and network detection tools are built to baseline normal communication and flag the anomalous, low-and-slow connections that beaconing produces.

The unifying idea is that command and control cannot hide its existence, only its appearance. The connection has to happen, repeatedly, across the network, so a defender watching egress traffic for the rhythm and the anomalies has a structural advantage the attacker cannot fully erase.

How to defend against command and control

Prevention narrows the routes the channel can use and the infrastructure it can reach.

• Filter egress traffic. Default-deny outbound where possible, and restrict which hosts can talk directly to the internet. The channel depends on outbound connectivity, so controlling egress is the most direct lever. Force web traffic through a proxy you can inspect and log.
• Control and monitor DNS. Route DNS through controlled resolvers, log queries, and block known-malicious and newly registered domains. Closing the DNS blind spot removes a favorite tunnel.
• Block known infrastructure. Feed current threat intelligence into firewalls, proxies, and DNS filtering to block known C2 domains and IPs, accepting that this is a moving target.
• Segment the network. Segmentation limits where a compromised host can reach and makes anomalous internal-to-external paths stand out, containing the blast radius if C2 is established.
• Disrupt fast in response. When the channel is found, blocking it and isolating the host cuts the attacker's control immediately, buying time to hunt for persistence and other footholds.

Layered, these do not guarantee an attacker can never establish a channel, but they shrink the options, force noisier choices, and make the connection easier to see and faster to cut.

Getting started with detecting C2

If you want to build the skill, learn to read the network traffic where this activity lives and recognize the patterns it makes.

1. Understand the callback model. Know why malware beacons outbound and how that defeats inbound firewalls. The concept reframes where to look.
2. Learn the channels. Get familiar with HTTP/HTTPS channels, DNS tunneling, and dead-drop relays, and what each looks like on the wire.
3. Hunt beaconing in real traffic. Practice spotting regular check-ins and extracting indicators from captures.
4. Map what you find to ATT&CK. Tie each observation to a Command and Control technique so an anomaly becomes a named behavior.

The bottom line

Command and control is the channel that turns malware into a remotely operated foothold, the line an attacker uses to send orders, run tools, move through the network, and pull data out. It almost always works on the callback model, with the implant beaconing outward so it slips past inbound firewalls as ordinary egress traffic, and it rides whatever blends in best: HTTPS, DNS, or a trusted cloud service used as a relay. That dependence on repeated communication is also the attacker's weakness, because the beaconing leaves a rhythm and the channel crosses the network where defenders can watch it. Hunt the beacon, watch DNS and egress, cut the channel, and you take away the attacker's hand on the keyboard. The malware that cannot phone home cannot be told what to do.