Command and control (C2)
In offensive operations, command and control is the channel an attacker uses to operate inside a compromised network and issue instructions to their implants. It is the part of an intrusion that has to keep talking, which makes it the most reliable thing for a defender to look for and the thing an operator works hardest to hide.
How it works
An implant on a compromised host contacts infrastructure the operator controls, asks for work, executes it and returns the result. The pattern is deliberately shaped to look ordinary: connections at intervals with random variation so the timing has no rhythm, traffic over the protocols that are always permitted outbound, and content that resembles whatever that protocol normally carries. Frameworks let an operator define the profile in detail, so the same implant can look like one kind of web traffic today and another tomorrow.
The channel is almost always outbound, because outbound is what firewalls permit. Where direct web traffic is filtered, operators fall back to whatever else leaves the network: name resolution, which is the basis of DNS tunnelling, mail, or a legitimate cloud service used as a relay so that the destination is a reputable domain.
What goes wrong
Egress is unrestricted. Most estates control what comes in with great care and allow essentially anything out from a workstation, which means the operator’s only real problem is choosing a protocol. Egress filtering that forces traffic through an inspecting proxy and denies direct outbound connections is the control that changes the difficulty, and it is the one most often absent from server networks in particular, where nothing should be browsing the web at all.
Detection based on destination reputation has the same ceiling as any indicator: it recognises infrastructure somebody else has already reported. Infrastructure stood up for one engagement, on a fresh domain with a valid certificate, matches nothing. What survives is behavioural analysis of the traffic pattern and, more practically, noticing that a host has begun talking to something it has never talked to before.
The third gap is the server estate. A workstation making unusual web requests is at least plausible; a database server doing it is not, yet the rules that would catch it are usually written for user networks.
Where this shows up in an audit
We build fresh infrastructure for every engagement, which is what makes the test honest, and we record every destination, protocol and interval so the client can search their logs afterwards. The measurable outcome is whether the channel was noticed and how long it ran, and where it was blocked we report which control did it, since knowing that the proxy stopped the first attempt and the fallback over name resolution succeeded is far more useful than a pass or fail. This is part of how we exercise your egress and network detection.