Skip to content

Command and control

Also known as C2

The channel a compromised machine uses to receive instructions from the attacker.

Once malware lands it needs to phone home. That channel might look like ordinary web traffic, DNS lookups, or traffic to a legitimate cloud service being abused as a relay, all chosen specifically so a firewall sees nothing unusual.

Beaconing patterns are the giveaway. A workstation quietly contacting the same destination at regular intervals, day and night, does not look like a person browsing, which is what DNS filtering and network detection are tuned to notice.

Where this comes up

Command and control sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.