What it is
Why it matters
Cut off the C2, and you break the attacker’s grip. Leave it running, and infected devices keep receiving fresh instructions, spreading, and exfiltrating data.
How it works
-
Infected hosts beacon to a domain/IP (often over HTTPS/DNS to blend in).
-
The C2 sends back commands (run tools, move laterally, encrypt files).
-
Operators rotate domains, proxies, or cloud services to stay hidden.
What you might notice
-
Repeating, short outbound connections to the same odd host
-
Legit tools (PowerShell, PsExec) launched in unusual ways
-
Security tools disabled, exclusions added, or updates failing
If you suspect C2 traffic
-
Isolate the host from the network (don’t just kill the process).
-
Block the destination domains/IPs at DNS/firewall.
-
Collect evidence (memory, logs), then remove persistence (tasks/services).
-
Reset credentials from a clean machine; hunt for other infected hosts.
Prevent it
-
Patch internet-facing apps; disable unused remote access.
-
Enforce MFA and least privilege for admins.
-
Use EDR/DNS filtering to catch beaconing patterns.
-
Segment networks and restrict egress to only what’s needed.
-
Train users to spot phishing and fake updates.
Not every periodic connection is C2
Software updates, monitoring agents, and cloud applications can create regular outbound traffic. Validate the destination, process, parent process, signing information, timing, DNS and TLS details, user context, and expected product behavior before declaring it malicious.
If C2 is likely
- Isolate the host while preserving volatile evidence and relevant network logs.
- Block confirmed indicators across DNS, proxy, firewall, and endpoint controls.
- Identify persistence, privileges, downloaded payloads, and accounts used from the host.
- Hunt for the same behavior across other devices and rotate exposed credentials.
- Remove the entry path or rebuild the system before returning it to service.
Blocking one domain does not remove malware and attackers may rotate infrastructure. A Cobalt Strike Beacon is one example of a post-exploitation agent that can use configurable C2 behavior.