What does C2 stand for in cyber security?

Command and control: the channel an intruder uses to reach software they have planted inside your network, issue instructions and collect what it has gathered. Also written C&C or CnC. The same abbreviation means other things elsewhere, so the security sense is often spelled out as C2 server or C2 channel.

The machine or service at the operator's end of that channel. It is normally rented and disposable, which is why blocking one is a short-lived win: the operator stands up another and the implant follows it.

The implant checking in with its operator on a schedule to ask for instructions. The regularity is the giveaway. Software talking to a server on a near-perfect interval, for hours, with small and similar payloads, is behaving like a machine waiting for orders rather than a person using an application.

How do you detect C2 traffic if it is encrypted?

By its behaviour rather than its content. Timing, regularity, payload sizes, the length of the relationship, the reputation and age of the destination and how the client negotiates its encryption are all observable without reading anything. Encryption hides what is said, not the fact or shape of the conversation.

What is the difference between C2 and exfiltration?

Purpose. C2 carries instructions and status, so it is usually small, regular and long-running. Exfiltration carries the data out, so it is usually larger and lopsided - far more leaving than arriving. They frequently use the same channel, which is why the direction and volume of bytes matter as much as the destination.

Is C2 the same as a botnet?

A botnet is many compromised machines controlled together, and it needs C2 to function. C2 is the control mechanism; a botnet is one thing you can build with it. A targeted intrusion against one organisation uses C2 and is not a botnet.

What are C2 frameworks like Cobalt Strike and Sliver?

Toolkits that give an operator a ready-made implant and server. Because they shape the traffic in characteristic ways, some detections are really framework fingerprints - useful, and brittle, since a fingerprint is a thing a competent operator can change. Behaviour-based detection is what remains when they do.

Can C2 hide in normal services like DNS or a cloud platform?

Yes, and it commonly does, because traffic to a well-known service is usually allowed out and rarely questioned. That is precisely why the destination's reputation is a weak signal on its own and the pattern of the conversation is the stronger one.

How long does it take to see a beacon?

Long enough to establish the rhythm. A single callback proves nothing; the regularity is the evidence, so a slow beacon checking in hourly needs more elapsed time than one checking in every thirty seconds.

What should we do when a C2 finding appears?

Contain the host first, not the destination. The infrastructure rotates and blocking it buys hours; the compromised machine is the asset that still has your credentials and your network access on it.

C2 Detection: Command-and-Control on the Network

C2 detection: find the channel, not yesterday's signature.

C2 is how an intruder keeps control of a machine inside your network. Modern C2 is built specifically to look like ordinary traffic, which is why detecting it has to be about behaviour rather than a list of bad addresses.

MITRE ATT&CK techniques covered: T1071 Application Layer Protocol · T1071.004 DNS · T1090 Proxy · T1568.002 Dynamic Resolution: DGA · T1571 Non-Standard Port

What C2 means in security, and what else the abbreviation stands for

C2 is short for command and control: the channel an intruder uses to reach software they have placed on a machine inside your network, to give it instructions and to receive what it has collected. Sometimes written C&C or CnC.

The abbreviation is used for other things entirely - command and control of forces in military doctrine, the top level of the European language framework, a vertebra - so the security sense is often written C2 server, C2 channel or C2 beacon to be unambiguous.

Inside security the word is also used loosely for four related but distinct things, and keeping them apart is what makes a detection claim meaningful:

The implant is the software on the compromised machine. Also called an agent, a beacon, a RAT or a backdoor depending on who is writing.
The channel is how that implant talks to its operator: HTTPS, DNS, a messaging platform, a cloud service, anything that gets out.
The infrastructure is what sits at the far end - the servers, domains and redirectors the operator rents, and the part they rotate when it gets blocked.
The framework is the toolkit used to run it all. Cobalt Strike, Sliver, Mythic and others. The framework shapes the traffic, which is why some detections are really framework fingerprints.

What command-and-control actually looks like now

The stereotype is a strange port talking to a strange country. Real operators stopped doing that years ago. What you get instead is traffic that is boring on purpose:

Ordinary ports and ordinary protocols. Usually 443, usually TLS, because blocking that is not an option for you.
Real, reputable destinations. Major cloud and CDN domains used as intermediaries, so a reputation lookup returns clean.
Long intervals with jitter. A check-in every few hours rather than every few seconds, tuned to sit below any threshold based on volume.
Tiny payloads. Just enough to ask for orders, so no byte-count alarm fires.
Channels nobody inspects. Control smuggled inside DNS queries or ICMP payloads, which very often walk straight past a web proxy.

How we detect it

The premise is that you cannot enumerate the destinations, so you have to characterise the conversation. A blocklist is a useful extra input, never the primary one.

Beacon rhythm. A machine talking to the same destination on a regular cadence, with the statistical regularity of a scheduled process rather than the irregularity of a person browsing.
Low-and-slow channels. Explicitly modelled, because the whole point of a long interval is to defeat detectors that only look at volume.
Encoded data in DNS. Measured with thresholds that account for the alphabet in use. A fixed entropy floor silently misses hex-encoded tunnels, because entropy is bounded by the character set, and we learned that the hard way rather than in theory.
Covert ICMP. Payload-carrying echo traffic, which is a control channel with no legitimate business purpose in most networks.
Protocol and port disagreement. A protocol appearing on a port that is not its own, which is a deliberate evasion far more often than an accident.
Client fingerprinting. Identifying the software making a TLS connection, so a scripted client pretending to be a browser stands out from a browser.
Relay and tunnel shapes. Traffic that arrives at one host and leaves it for elsewhere, which is how a foothold becomes a route.

The limits, up front

We do not decrypt TLS. The detections above are about timing, size, rhythm, destination and fingerprint, not about reading contents. That is a deliberate design choice and it is also why deployment does not require you to hand us keys or break inspection.

It also means a single-shot transfer with no ongoing channel is a different problem, handled by exfiltration detection rather than beacon detection. We would rather draw that line clearly than imply one detector covers everything.