What is Command and Control?
Command and Control (C2) refers to the infrastructure and communication channels adversaries use to remotely direct malware on compromised systems, issuing commands, receiving stolen data, and managing implants within the victim network.
Definition
- Command and Control
- Command and Control (C2) refers to the infrastructure and communication channels adversaries use to remotely direct malware on compromised systems, issuing commands, receiving stolen data, and managing implants within the victim network.
How Command and Control Works
After establishing persistence, malware needs a way to receive instructions and send back results. The C2 channel must be covert, evading network security controls.
Early C2 used IRC or raw TCP connections, easily blocked. Modern C2 frameworks (Cobalt Strike, Mythic, Sliver) default to HTTPS that blends with normal browsing. Domain fronting uses CDN infrastructure to hide the true C2 destination. DNS-based C2 encodes commands in DNS queries and responses, difficult to block because DNS is essential. DGAs continuously rotate C2 domains to evade blocklists.
C2 detection targets: unusual beacon timing patterns (malware checking in at regular intervals), connections to newly registered or low-reputation domains, high volumes of encrypted traffic to unusual destinations, DNS queries for algorithmically generated domains, and HTTPS connections with invalid or self-signed certificates.
Command and Control in SOC Operations
C2 detection is high-value. Identifying active C2 means the attacker has a live channel into the environment. Blocking C2 cuts off attacker access before they achieve their objectives. NDR and SIEM correlation are your primary detection tools: NDR identifies anomalous network patterns while SIEM correlates DNS, proxy, and firewall logs to surface suspicious external communications.
Practice Command and Control in a Real SOC
SOCSimulator provides hands-on training with realistic SIEM, XDR, and Firewall interfaces. Build real analyst skills investigating command and control scenarios with zero consequences — free forever.
Related Terms
Persistence refers to techniques adversaries use to maintain access across reboots, credential chang...
Lateral movement is the attack phase where adversaries expand access from an initial foothold to add...
Data exfiltration is the unauthorized transfer of sensitive data from a victim environment to attack...
Network Detection and Response (NDR) is a security platform that passively monitors network traffic ...
An Indicator of Compromise (IOC) is an observable artifact, such as a file hash, IP address, domain ...
More Threats Terms
Related SOC Training Resources
Threat Hunter Career Guide — Salary & Skills
Threat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathIncident Responder Career Guide — Salary & Skills
Incident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more Career PathSOC Analyst (Tier 2) Career Guide — Salary & Skills
Tier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more ComparisonSOCSimulator vs Hack The Box — Comparison
Different tools for different career paths. SOCSimulator trains defensive analysts. Hack The Box trains offensive securi…
Read more ComparisonSOCSimulator vs TryHackMe — Comparison
SOCSimulator is the better tool for dedicated SOC analyst preparation. TryHackMe is the better tool for broad cybersecur…
Read more ToolFirewall Training Console — SOCSimulator
The Firewall console in SOCSimulator replicates the log analysis experience of enterprise platforms like Palo Alto Netwo…
Read more ToolSIEM Training Console — SOCSimulator
The SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ToolXDR Training Console — SOCSimulator
The XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more TechniqueMITRE ATT&CK Techniques — Detection Training Library
Browse all MITRE ATT&CK techniques with detection strategies and example alerts.
Read more Career PathCybersecurity Career Paths — 2026 Guide
Explore SOC analyst career paths with salary data, required skills, and certification roadmaps.
Read more PlaybookSOC Investigation Playbooks — Step-by-Step Guides
Practitioner investigation playbooks with decision trees and real SIEM queries.
Read more FeatureShift Mode — Real-Time SOC Simulation
Practice alert triage under realistic time pressure with SLA timers and noise injection.
Read more