thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Command and Control (C2)

Infrastructure and channels attackers use to communicate with and control compromised systems.

Definition

C2 traffic lets attackers issue commands, receive stolen data and deliver additional payloads. It is often disguised within HTTPS, DNS or legitimate cloud services and may use domain generation algorithms or fast flux for resilience. Detecting and blocking C2 is a key containment step and corresponds to the Command and Control tactic in MITRE ATT&CK.

Example

An implant sending HTTPS requests every 60 seconds to a newly registered domain for tasking.

Exam tip

Kill chain stage 6 is command and control (C2); beaconing patterns are the classic indicator.

Related terms