Glossary
COMMAND AND CONTROL / C2
defined.
The infrastructure and channels an attacker uses to communicate with compromised hosts — issuing commands and receiving results.
A–Z
The infrastructure and channels an attacker uses to communicate with compromised hosts — issuing commands and receiving results.
Modern C2 frameworks (Cobalt Strike, Sliver, Mythic, Havoc) use HTTPS, DNS, or third-party services to blend in with legitimate traffic. Detection requires behavioural analysis (beaconing patterns, JA3 fingerprints, certificate transparency) rather than IP/domain blocklists.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.