Glossary
Command and Control (C2)
When malware infects your computer, it needs to phone home to the hackers for instructions. Command and control (C2) is how hackers talk to their malware - telling it what to steal, when to attack, or how to spread. Blocking C2 traffic can stop an attack in its tracks.
What is Command and Control (C2)?
The infrastructure and communication channels that attackers use to maintain contact with compromised systems, send commands, and exfiltrate stolen data.
Why Should You Care?
Without blocking command-and-control (C2) communications, compromised systems remain under attacker control regardless of how the initial breach occurred—the attacker can exfiltrate data, deploy additional malware, or pivot to other systems on your network. Defenders who detect and sever C2 channels can regain control of infected endpoints and prevent further damage. Organizations that fail to monitor for C2 activity often don't discover breaches until weeks or months later, when attackers have already stolen sensitive information or established persistent access.
Is your business exposed?
Real-World Example
A common scenario: a phishing email installs a backdoor that periodically beacons out to an attacker's command server, waiting for instructions. If network monitoring detects and blocks that beacon to a known-malicious domain, defenders can quarantine the infected machine before the attacker issues commands to steal credentials, move laterally, or deploy ransomware. Identifying C2 traffic—unusual outbound connections, regular beaconing intervals, or traffic to newly registered domains—is one of the most reliable ways to catch an active intrusion.
How to Protect Against Command and Control (C2)
- 1.
Block known C2 domains and IPs at firewall
- 2.
Monitor outbound traffic for suspicious patterns
- 3.
Use DNS filtering to block malicious domains
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required