command and control
termsecurity
Stands for: C2
The channel a compromised host uses to receive instructions and report back.
It is the most reliably detectable stage of an intrusion, because it has to be repetitive: something must check in, and checking in leaves a rhythm. That is why detection focuses on beaconing - regular intervals, consistent sizes, a destination no other host in the estate talks to - rather than on content, which is encrypted. Modern channels hide in ordinary services precisely to defeat that, using cloud storage, chat platforms and DNS, so the useful signal is often a host talking to something normal in an abnormal pattern.
Also known as: C2