What Is a C2 Server? Command and Control Explained

A C2 server (command-and-control server) is the computer an attacker uses to send instructions to machines they have compromised and to collect data back from them. Code planted on each victim host checks in on a schedule, picks up its next task and returns the results, usually inside ordinary-looking web or DNS traffic. Almost every hands-on intrusion, from ransomware to espionage, depends on that channel staying open, which makes it one of the best places to catch an attacker. Our guide to how ransomware attacks work shows where C2 sits in that chain.

Whether your own monitoring would spot a live C2 channel is the central question of a red team assessment, which starts at $12,500, fixed in writing, with a free retest of remediated technical findings.

What is a C2 server?

The term is borrowed from military command and control, a commander’s authority and direction over assigned forces. MITRE ATT&CK treats it as its own tactic, Command and Control (TA0011): the adversary “is trying to communicate with compromised systems to control them.” As of ATT&CK v20.1, checked in November 2026, it lists 18 techniques under that tactic.

“C2 server” is shorthand for a setup with four parts, and only some of them ever reach your logs:

Component	What it is	What defenders see
Team server	The attacker’s backend: queues tasks, stores results, tracks every compromised host	Almost never seen directly
Implant, agent or beacon	Code on the victim machine that checks in and carries out tasks	Process behavior, memory artifacts, outbound connections
Listener or channel	The protocol the implant speaks: HTTPS, DNS, SMB named pipes, a cloud API	Proxy, DNS, firewall and endpoint network logs
Redirectors	Disposable servers or CDNs that relay traffic so the team server’s address never appears	The only infrastructure in your logs, which is why blocking one IP rarely ends an intrusion

Botnets use the same design at scale. CISA’s QakBot advisory describes infected machines upgraded into relay “supernodes” (853 in 63 countries by mid-June 2023) that forwarded traffic through proxies to one top-tier C2 server. When the FBI and partners took over that infrastructure in August 2023, the bots lost their controller. Without C2, an implant is dormant code.

C2 networks follow three broad designs: centralized, with every implant reporting to one server, usually behind redirectors; peer-to-peer, with infected hosts relaying commands for each other; and tiered or decentralized, like QakBot’s, with layers of relays, or cloud services and public sites used as dead drops.

How command and control works

The life of a C2 channel follows the same arc whatever the tool, and each stage leaves something to detect.

• First check-in. After initial access (a phishing attachment, an exploited internet-facing service, a stolen VPN login), the implant registers the host with the C2 server: name, user, privileges.
• Beaconing. The implant sleeps, wakes, asks for tasks and sleeps again. Operators add jitter, a random variation in the interval, so the rhythm is not perfectly regular. Long sleeps are quiet but slow; interactive work shortens them and generates far more traffic.
• Tasking. Queued commands ride back on the next check-in: run a command, pull down another tool, harvest credentials, move to another host.
• Pivoting. Internal machines without internet access are chained through one that has it, typically over SMB named pipes. Only that egress host talks to the outside. Pivoting is one form of lateral movement, which has its own detection points.
• Exfiltration. Stolen data often leaves over the same channel, split into small uploads or DNS queries that look like routine traffic.

Modern implants pull instructions over outbound connections. Inbound connections are blocked nearly everywhere; outbound HTTPS and DNS are allowed nearly everywhere. That is why egress control, not the inbound firewall, decides whether C2 works in your network.

C2 channels: where the traffic hides

Attackers pick channels that look like traffic you already allow.

Channel	ATT&CK ID	Why attackers use it	Where defenders see it
HTTPS to an attacker domain	T1071.001, T1573	Blends with browsing, encrypted	Proxy logs, TLS metadata, endpoint connection logs
DNS	T1071.004	Allowed almost everywhere, even from servers	Resolver logs: long encoded subdomains, high volume, heavy TXT use
Legitimate web services	T1102	Trusted cloud, messaging or storage domains	Proxy or CASB logs: unexpected processes calling service APIs
Domain fronting	T1090.004	Real destination hidden behind a reputable CDN; many major CDNs now block it, so it is rarer than it was	TLS inspection: SNI and HTTP Host header name different domains
Internal peer-to-peer	T1090.001	Hosts with no internet route through one that has it	Named pipe events, SMB between workstations
Fast flux and DGAs	T1568.001, T1568.002	Domains and IPs change faster than blocklists	Many IPs with short TTLs, bursts of failed lookups
Remote access tools	T1219	Signed software IT may already allow	Software inventory, application control logs
Tunneling, odd ports	T1572, T1571	C2 wrapped inside another allowed protocol	Flow logs: long-lived sessions, uncommon ports

Two of these have drawn joint government warnings. NSA, CISA, the FBI and partners in Australia, Canada and New Zealand published Fast Flux: A National Security Threat in April 2025, urging protective DNS that detects fast flux, with coverage confirmed with the provider. In AA23-025A, CISA, NSA and MS-ISAC warned that attackers use remote monitoring tools such as ScreenConnect and AnyDesk for persistence and C2.

C2 frameworks, including Cobalt Strike and Sliver

A C2 framework packages all of this: the team server, the implant builder, the listeners and a shared console for several operators. Red teams use them to emulate real adversaries; criminals and state groups use the same ones, often pirated.

Cobalt Strike

Cobalt Strike, a commercial adversary simulation tool made by Fortra, is the best known, and cracked older copies became a ransomware staple, serious enough that Microsoft, Fortra and Health-ISAC obtained a court order on March 31, 2023 to disrupt servers running them. Our Cobalt Strike explainer covers its Beacon implant and how to detect it.

Sliver C2

Sliver is an open-source C2 framework developed by Bishop Fox. MITRE ATT&CK describes it as an “open source, cross-platform, red team command and control (C2) framework written in Golang,” with channels over mutual TLS, WireGuard, HTTP(S) and DNS, and lists APT29 among its users. Microsoft has seen nation-state actors and ransomware affiliates adopting Sliver, with or in place of Cobalt Strike. Implants run in beacon mode, checking in periodically, or session mode, a real-time interactive connection (Cybereason’s incident response team, in an analysis now published on the LevelBlue blog, describes both), so hunt for both shapes. Microsoft points to two tells. Default listeners show distinctive HTTP header combinations and JARM fingerprints. And by default the sideload, spawndll and execute-assembly commands start notepad.exe and inject into it, which Sysmon Event IDs 8 and 10 can surface.

Mythic, Havoc, Brute Ratel C4 and the Metasploit Framework (see msfvenom explained) also turn up in threat reports; our red team tools guide covers who maintains each and how red teams choose.

Framework signatures age quickly because operators customize traffic profiles, certificates and implant behavior, so detection that lasts targets what every framework must do: a process that has no business on the network contacting the same destination at steady intervals, code injected into another process, a domain no one else in the company visits.

What a working C2 channel reveals about your environment

When an implant beacons for days without challenge, each outcome points to a control that let it through and a specific fix:

What happened	What it tells you	The fix
A workstation reached an attacker domain directly	Egress is default-allow, or the proxy can be bypassed	Force web traffic through an authenticated proxy
A server opened outbound HTTPS or DNS	Servers have internet access they do not need	Default-deny server egress; allow named update endpoints only
DNS C2 worked	Endpoints resolve anything, uninspected	Internal resolvers only, protective DNS upstream, block unapproved DNS over HTTPS
A days-old, uncategorized domain was allowed	Web filtering trusts unknown destinations	Hold newly registered and uncategorized domains
EDR recorded the activity but nothing alerted	Telemetry exists; detection logic does not	Build and test detections against real tradecraft
An alert fired but nobody acted for days	Detection works, response does not	Rehearsed escalation paths and runbooks
The implant lived on a VPN appliance	No visibility on devices that cannot run EDR	Forward appliance logs and keep them long enough

That last row is where the longest intrusions hide. Mandiant’s M-Trends 2026 reports that global median dwell time rose to 14 days from 11, notes that VPNs and routers typically lack EDR telemetry, and warns that with backdoors like BRICKSTORM reaching dwell times of nearly 400 days, standard 90-day log retention leaves organizations blind to how an intrusion began.

How to detect C2 traffic

No single log catches C2. Endpoint telemetry tells you which process is talking; network telemetry tells you how. You need both, joined on host and time.

Log source	Event or field	What to look for
Sysmon Event ID 3 (network connection)	Process, destination, port	Office apps, script hosts or binaries in user-writable folders calling out. Off by default; enable it
Sysmon Event ID 22 (DNS query)	Process, query name	Non-browser processes resolving many long or random-looking subdomains
Windows Security Event 5156 (Audit Filtering Platform Connection)	Application, destination	Servers that should never reach the internet doing so. Not audited by default and very high-volume: enable on servers or filter at collection
Sysmon Event IDs 17 and 18 (named pipe created, connected)	Pipe name, process	Unusual pipe names between workstations: peer-to-peer C2
Sysmon Event IDs 8 and 10 (CreateRemoteThread, ProcessAccess)	Source and target process	Injection into other processes, where most implants hide
Proxy or secure web gateway	URL, category, user agent, bytes	New or uncategorized domains, user agents matching no installed browser, uniform sizes
DNS resolver logs or Zeek dns.log	Query, record type, TTL	TXT-heavy traffic, NXDOMAIN bursts (DGA), short-lived IPs (fast flux)
TLS metadata (Zeek ssl.log and x509.log, or an NDR sensor)	SNI, certificate, JA4 or JA3 fingerprint (Zeek needs add-on packages for these; JA3 is unreliable for modern browsers)	Self-signed or default certificates, client fingerprints matching no approved software
Firewall or flow logs	Duration, bytes, timing	Near-regular intervals over hours, very long sessions, uncommon ports
Threat intelligence feeds, matched against proxy, DNS and firewall logs	Known C2 IPs, domains, certificates	Hits on published C2 indicators: catches commodity C2, misses infrastructure built for one target

Sysmon event definitions are in Microsoft’s Sysmon documentation. Inspect TLS where you can, and log SNI and certificates where you cannot.

Beaconing analysis and rarity are the two hunts most worth running. Jitter randomizes single intervals, but over a day the connections from one host to one destination still cluster around a central value, with similar payload sizes. Score each host and destination pair on connection count, interval regularity and size consistency, then review the outliers. For rarity, a domain that one host contacts every few minutes, around the clock, and no other host ever touches deserves a look whatever its reputation says.

A beaconing hunt you can run today

The hunt works in any tool that records outbound connections per device. In Microsoft Defender XDR advanced hunting that data is in the DeviceNetworkEvents table. The hunt measures the gap between successive connections from each device to each public address over 24 hours, then keeps the pairs with many connections and a near-constant gap.

1. Take successful outbound connections to public addresses over a day or more.
2. Group them by device and remote address, and measure the gap between one connection and the next.
3. Keep the pairs with many connections (50 or more) and a steady rhythm: the spread of the gaps is small compared with the average gap. Call that ratio Regularity, and keep the pairs where it is below 0.3.
4. Sort by Regularity, lowest first, and note which process opened each connection.

A Regularity value near zero means a metronome. Jitter pushes the value up, so 0.3 is a deliberately loose cut-off. Expect software updaters, monitoring agents and chat clients in the first results. Exclude those you recognize, then look at what is left: an unfamiliar process, or a common one such as rundll32.exe or notepad.exe that should not be on the network at all. Treat the thresholds as a starting point and tune them to your traffic. If you collect Zeek logs instead, the open-source tool RITA from Active Countermeasures runs the same kind of beacon scoring on them.

Detecting C2 on Linux servers and cloud workloads

The log sources above are mostly Windows, but implants also run on Linux servers, containers and cloud instances, which often have thinner endpoint coverage. The questions stay the same (which process is talking, and to what); the logs differ.

Where	Log source	What to look for
Linux host	auditd rules on the connect and execve system calls, or an EDR sensor for Linux	A web server, database or scheduled job opening outbound connections; programs running from /tmp, /dev/shm or a home directory
Linux host	systemd units, cron entries and shell profile files under change monitoring	A new service or cron job that relaunches an unknown binary; a running process whose executable has been deleted from disk
AWS network	VPC Flow Logs	Instances in private subnets reaching the internet, small steady flows to one address, ports the workload never uses
AWS DNS	Route 53 Resolver query logs	Long encoded subdomains; domains only one workload resolves
AWS account	CloudTrail	API calls made with an instance role’s credentials from an address outside your cloud, a sign the credentials were taken off the instance
AWS managed detection	GuardDuty EC2 findings	Backdoor:EC2/C&CActivity.B (from flow logs) and Backdoor:EC2/C&CActivity.B!DNS (from DNS logs): an instance contacting an address or domain tied to a known C2 server
Any network	Zeek or Suricata on a traffic mirror or gateway	The same beaconing, DNS and TLS signals as in the table above

Azure virtual network flow logs and Google Cloud VPC Flow Logs give the same network view on those platforms. The fix is also the same as for Windows servers: default-deny egress from server subnets, with named update and API endpoints allowed, so a new outbound destination is an alert and not background noise.

How to prevent and contain C2

The fixes in the table under “What a working C2 channel reveals about your environment” cover egress, DNS and domain filtering. Three more controls close most of the remaining gap. Trust none of them, or any detection rule, until a test has shown it working:

1. Stop the implant from running. Application control in enforce mode and EDR in block mode stop default-configured and commodity implants before the first check-in. Custom loaders still get through, which is why the next layers matter.
2. Allowlist only the remote access tools you have approved and block the rest through application control, including portable versions, as CISA, NSA and MS-ISAC recommend. Standardizing on one tool means any other that appears is an alert.
3. Restrict SMB between workstations to break peer-to-peer chains. Our firewall penetration testing guide covers how testers check segmentation and what can actually leave.

How Invadel tests C2 detection, and what it costs

In a red team assessment our operators stand up C2 infrastructure for your engagement, with channels chosen to resemble the adversaries in your threat model (how we pick them is in crafting realistic red team scenarios). Implants run only on systems the written rules of engagement name, and a deconfliction channel keeps a real incident from being mistaken for the exercise.

We test each layer in turn, the approach in offense in depth: does the implant run, does it get out, which channel works, how long until someone notices, and does the response cut it off. The report gives time to detect and time to respond for each phase, with every technique timestamped and mapped to MITRE ATT&CK so your SOC can replay it against its own alerts.

Engagement	What it answers about C2	Starting price
Red team, Small	One objective and one or two access vectors: is a live channel from inside your network seen and cut off?	$12,500
Red team, Medium	Several objectives, with phishing, external and internal phases: does C2 set up after the phish get through your egress controls?	$17,000
Red team, Large	Multi-scenario across a large or multi-site estate, with deep evasion and a purple-team debrief: how long can quiet channels run?	$29,000+
Purple team assessment	Runs C2 openly with your defenders, tunes detections in the room, re-runs missed techniques to prove the new detections fire	Quoted
Internal network penetration test	Every path from a foothold, IT aware; not a covert detection test	$6,000

Once you have tightened egress or built the missing detection, the free retest of remediated technical findings checks that the channel which got out is now blocked or alerted on. If you are deciding between the covert rows and the internal test, red teaming vs penetration testing sets out which question each one answers. Prices are fixed in writing, the attestation letter and findings platform are included, and onboarding begins within 24 hours of a signed proposal. See the red team pricing or a sample report, or send scope details through the scoping questionnaire.

Frequently asked questions

What does C2 mean in networking? C2 stands for command and control: the channel an attacker uses to send instructions to compromised machines and receive data back. The C2 server is the attacker’s end of that channel.

What is a C2 network? It is the full set of attacker infrastructure and infected hosts: the C2 server, any relays or redirectors, and every implant that checks in. Large botnets layer it in tiers, as QakBot did, so taking down one relay does not end the network.

What is C2 in military terms? Command and control is the exercise of authority and direction by a designated commander over assigned forces. Security borrowed the term because an attacker directing compromised machines is doing the same thing at a distance.

Is a C2 server the same as a botnet? No. A botnet is the collection of infected machines; the C2 server is what controls them. Cut the bots off from it, as the FBI and partners did with QakBot in 2023, and they sit idle.

What is the difference between a C2 server and a C2 framework? The C2 server is the attacker’s backend that implants report to. A C2 framework is the software package that provides that server along with the implant builder, the listeners and the operator console. Cobalt Strike and Sliver are frameworks; a team server built with either is a C2 server.

What ports and protocols does C2 traffic use? Mostly the ones you already allow out: HTTPS on TCP 443 and DNS on port 53, followed by trusted cloud and messaging APIs, approved remote access tools and, inside the network, SMB named pipes on TCP 445. Blocking unusual ports helps a little, but most C2 is found by behavior on allowed ports, not by port number.

How long does C2 usually go undetected? It varies widely. Mandiant’s M-Trends 2026 puts global median dwell time, the time an attacker is present before detection, at 14 days, and the same report describes backdoors on network appliances that stayed in place for nearly 400 days. A red team exercise gives you your own number.

Can a firewall block C2 traffic? Partly. Default-deny egress with a forced proxy stops the simplest channels, but C2 riding HTTPS to trusted cloud services, or DNS through your own resolvers, passes most firewalls. Blocking it takes DNS control, reputation filtering and endpoint detection together.

How much does it cost to test whether we would detect C2? A red team assessment that runs a live, covert C2 channel against your monitoring starts at $12,500, with a free retest of remediated technical findings. A purple team assessment that tunes detections alongside your SOC is scoped and quoted.

The short version

A C2 server is the attacker’s control point for every machine they compromise, and the channel to it is the one thing an intrusion must keep open. It hides in HTTPS, DNS, trusted cloud services and approved remote access tools, so catching it takes endpoint and network telemetry together, tight egress and detections tested against real tradecraft. A red team assessment runs a live C2 channel against your monitoring and measures how long your team takes to see it and shut it down, from $12,500 with a free retest. Send your scope details for a fixed quote.