MITRE ATT&CK Command and Control (TA0011): Detect, investigate, and respond

What is command and control in MITRE ATT&CK?

Command and Control (C2) is a tactic in the MITRE ATT&CK framework (TA0011) that describes how adversaries communicate with systems they have compromised within a victim's network. C2 channels serve as the attacker's remote control mechanism, every instruction to move laterally, collect data, escalate privileges, or deploy ransomware flows through the C2 channel. Without C2, an attacker loses the ability to direct their intrusion.

C2 detection is one of the most valuable detection categories for security operations teams because every active intrusion requires a C2 channel. While attackers can vary their initial access method, credential theft technique, or lateral movement approach, they always need a way to communicate with compromised systems. The CrowdStrike 2025 Global Threat Report found that 100% of interactive intrusions maintained at least one C2 channel, and the average intrusion used 2.4 distinct C2 methods for redundancy.

The challenge of C2 detection is that modern C2 frameworks are specifically designed to blend with legitimate traffic. Tools like Cobalt Strike, Sliver, Brute Ratel C4, and Havoc use encrypted HTTPS, domain fronting, legitimate cloud services, and traffic shaping to make C2 communications indistinguishable from normal web browsing. Despite this sophistication, C2 traffic leaves detectable patterns in network metadata - connection timing, certificate characteristics, domain reputation, and traffic volume ratios.

This guide covers the four C2 techniques that represent the highest detection priority - Encrypted Channel (T1573), Application Layer Protocol (T1071), Proxy (T1090), and Non-Standard Port (T1571) - and demonstrates how to build comprehensive detection using ManageEngine Log360 and its 85 prebuilt C2 detection rules.

Why C2 detection is critical

Command and Control is the attacker's lifeline throughout an intrusion. Without it, the attacker cannot:

• Issue commands - Every lateral movement step, credential dump, and collection operation requires instructions from the operator. No C2 means no new attack activity.
• Receive stolen data - Collected data must be exfiltrated through the C2 channel or a secondary channel coordinated through C2.
• Deploy ransomware - Ransomware deployment requires real-time operator control to ensure simultaneous execution across all targets. C2 loss prevents coordinated deployment.
• Maintain access - While persistence mechanisms provide a way back in, active operations require real-time C2. Blocking C2 forces the attacker to re-establish access from scratch.

The C2 lifecycle

The Mandiant M-Trends 2025 report found that average attacker dwell time is now 10 days. Throughout this entire period, C2 channels are active creating 10 days of detectable network patterns. Organizations with effective C2 detection reduce dwell time to under 48 hours on average.

C2 techniques in MITRE ATT&CK

MITRE ATT&CK catalogs 16 techniques under Command and Control. Four of these account for the vast majority of real-world C2 implementations and provide the strongest SIEM detection opportunities.

Understanding C2 architecture

---

How C2 attacks work: real-world scenarios

Scenario 1: Cobalt Strike HTTPS beaconing (T1573 + T1071)

An attacker deploys a Cobalt Strike beacon via phishing. The beacon connects to the C2 server over HTTPS port 443, blending with legitimate web traffic. The beacon checks in every 60 seconds with 20% jitter, making the interval appear random (48-72 seconds).

What Log360 detects

• Beaconing pattern analysis - Log360 analyzes firewall connection logs for periodic outbound connections to the same destination, identifying the underlying beacon interval despite jitter.
• Self-signed TLS certificate - The C2 server's TLS certificate is self-signed or issued by an uncommon CA. Log360 flags connections to servers with suspicious certificate properties.
• Low-reputation domain - The C2 domain was recently registered and has no historical traffic. Log360 correlates with threat intelligence feeds to flag connections to newly observed domains.
• JA3/JA3S fingerprint - The TLS client hello from the beacon has a known Cobalt Strike JA3 fingerprint, matched against Log360's threat intelligence.

Scenario 2: DNS tunneling for data exfiltration (T1071.004)

An attacker uses iodine or dnscat2 to tunnel C2 communications through DNS queries. Each DNS query encodes a small amount of C2 data in the subdomain label, and responses carry commands in TXT records. Because DNS is rarely blocked, this provides a reliable covert channel.

What Log360 detects

• High DNS query volume to single domain - Normal hosts make few queries per minute; DNS tunneling generates hundreds to thousands of queries to the tunnel domain.
• Long subdomain labels - Base64-encoded data in subdomain labels creates unusually long DNS queries (50+ characters vs. normal 10-20).
• TXT record query anomaly - TXT queries to non-standard domains are uncommon in normal operations and strongly indicate DNS tunneling.
• Entropy analysis - The subdomain labels have high Shannon entropy (appearing random), unlike normal human-readable domain names.

Building a C2 detection strategy with Log360

Critical log sources

• Firewall connection logs - Source/destination IP, port, protocol, bytes sent/received, connection duration, and session count. Essential for beaconing detection and non-standard port identification.
• DNS query logs - Full query string, response type, query frequency, and client IP. Critical for DNS tunneling and DGA detection.
• Web proxy logs - Full URL, user agent, HTTP method, response code, TLS certificate details, and traffic volume. Enables detection of HTTP-based C2 and domain fronting.
• TLS inspection logs - Certificate issuer, validity, subject alternative names (SANs), and JA3/JA3S fingerprints. Detects self-signed certificates and known C2 framework fingerprints.
• NetFlow/IPFIX - Connection metadata at scale for beaconing analysis when full packet capture is not available.

Detection approach by layer

Investigation and response

When a C2 alert fires

• Validate the C2 indicator - Confirm the destination is not a legitimate service. Check domain registration, certificate details, historical traffic, and threat intelligence lookups.
• Identify all affected hosts - Query for other hosts connecting to the same C2 destination. Multiple hosts indicate the attacker has already moved laterally.
• Determine the C2 framework - Identify whether it is Cobalt Strike, Sliver, Brute Ratel, or commodity malware based on traffic patterns, JA3 fingerprints, and URI structures.
• Assess what occurred over C2 - Review endpoint logs for the compromised host to determine what commands were executed, what data was collected, and whether lateral movement occurred.
• Block and isolate - Add the C2 destination to firewall block lists, isolate the compromised endpoint from the network, and search for persistence mechanisms the attacker may have deployed.
• Hunt for additional C2 - Attackers often deploy multiple C2 channels for redundancy. Search for other unusual outbound connections from the compromised host and from hosts it touched during lateral movement.

Prevention

• Deploy TLS inspection - Inspect outbound HTTPS traffic at the proxy to analyze certificate properties, detect self-signed certificates, and identify known C2 framework patterns hidden within encrypted channels.
• Restrict outbound DNS - Force all DNS queries through internal resolvers and block direct DNS to the internet. Monitor internal DNS for tunneling indicators.
• Block uncategorized domains - Use web proxy policies to block access to newly registered or uncategorized domains. Most C2 infrastructure uses domains less than 30 days old.
• Implement application-aware firewalling - Use next-gen firewall capabilities to identify protocol mismatches (e.g., non-HTTP traffic on port 443) that indicate C2 channel abuse.
• Network segmentation - Segment internal networks so compromised workstations cannot reach sensitive servers directly. Force traffic through choke points where inspection rules apply.
• Endpoint detection - Deploy EDR to detect C2 implant processes on endpoints, complementing network-based detection with host-level visibility.

Need to explore ManageEngine Log360? Schedule a personalized demo

FAQ