Attacks and malware
What is Command and control?
The channel a compromised machine uses to reach the operator for instructions. Often shortened to C2.
Command and control, usually written C2, is the channel a compromised machine uses to contact the attacker for instructions and to send results back. It can run over HTTPS, DNS, cloud services, chat platforms or almost anything else that leaves the network.
For defenders C2 is a strong detection point because the malware has to talk. Regular check-ins (beaconing), unusual domains, rare user agents and traffic to newly registered infrastructure are all signs of a C2 channel.