Command And Control (C2).

What is command and control (C2)?

Command and control, often shortened to C2, is the way an attacker talks to systems they have already compromised so they can control them. MITRE ATT&CK lists Command and Control as a tactic, with the ID TA0011. It describes the goal in one line: the adversary is trying to communicate with compromised systems to control them.

A C2 server is the system an attacker uses on their side of that link. The words C2 infrastructure and C2 channel refer to the servers and the communication path as a whole.

How does command and control work?

The attacker’s malware or tool on a compromised system makes contact with the attacker’s infrastructure. Through that link the attacker can send instructions to the system. The tactic is the part of an attack that keeps this line open.

MITRE ATT&CK groups the ways of doing this into 18 techniques under the tactic. Examples include Application Layer Protocol, Encrypted Channel, Proxy, Web Service and Fallback Channels. This shows that C2 traffic can take many forms.

How can attackers hide C2 traffic?

MITRE says adversaries may use application layer protocols, which are the common protocols programs use to talk over a network, to avoid detection and network filtering by blending in with existing traffic. Its sub-techniques for this include web protocols, file transfer protocols, mail protocols and DNS.

MITRE also describes Dynamic Resolution. MITRE says adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. Its sub-techniques are Fast Flux DNS, Domain Generation Algorithms and DNS Calculation.

Fallback Channels are a related technique. MITRE says adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible, to maintain reliable C2 and to avoid data transfer thresholds.

A simple illustration

This is a generic illustration only. A compromised laptop sends a small web request to an outside server. The server replies with an instruction. To a quick look, the request resembles normal web browsing, which is the kind of blending in that MITRE describes.

How can C2 be detected or reduced?

MITRE suggests several defensive ideas. For Application Layer Protocol, it lists filtering network traffic and network intrusion prevention as mitigations. For Dynamic Resolution, it says defenders should correlate high-frequency or anomalous DNS query activity with processes that do not usually make network requests. It also points to pseudo-random domain lookups and to audit logs showing repeated failed DNS lookups to high-entropy domain names.

MITRE notes that network intrusion prevention based on signatures can identify some malware variants, but it requires resource-intensive reverse engineering. For Fallback Channels, MITRE also says defenders should recognize that adversaries will likely change tool C2 signatures over time to evade detection.

Is command and control the same as a C2 server?

Not exactly. Command and control is the tactic, the overall goal of keeping a channel to compromised systems. A C2 server is one piece of infrastructure used to reach that goal. People often use the two phrases loosely for the same idea, and this entry covers both.

Are C2 and C&C the same thing?

Yes. C2, C&C and command-and-control all name the same idea. The term C2 server is also written as command-and-control server.

Where does C2 sit among other terms?

Command and control is one tactic in the MITRE ATT&CK framework. See the related terms below for the framework itself.