Command and
control attack


Content in this page

  • What is a C2 attack?
  • About the attack
  • Attack flow
  • Types of C2 techniques
  • Risks of C2 attack
  • Indicators of compromise (IoCs) for a C2 attack
  • Detection mechanism
  • Detect and mitigate C2 attacks using Log360

What is a C2 attack?

A command and control (C2) attack involves a compromised system, often referred to as a bot, being controlled remotely by an attacker through a C2 server. Through the server, the attacker communicates with a remote server and coordinates the attack, utilizing a backdoor for malicious tasks like data theft via DNS tunneling. If the malware spreads to other devices, the attacker can gain full control over the system.

X, then known as Twitter, was subjected to a sophisticated hack in February 2013 conducted by the hacking group Wild Neutron (also known as Morpho and Jripbot). This incident involved a C2 attack strategy. Approximately 250,000 user accounts were compromised in the breach, enabling access to vital details like user names and emails. In the same year, Facebook, Apple, and Microsoft also fell victim to similar attacks.

In all of these incidents, attackers exploited vulnerabilities within the targeted organizations' systems, aiming to gain unauthorized access and control. This granted them access to valuable user data, including user names and email addresses. These attacks highlighted the vulnerabilities present within these tech giants' networks and underscored the growing threat of C2 attacks as a means of breaching secure systems.

About the attack

C2 operations follow a structured framework, with command servers represented as dedicated objects within the system's architecture. These servers reside exclusively in configuration or domain partitions.

Here are the essential prerequisites to execute an effective C2 attack:

  • 1 Possession of valid authentication credentials, enabling the establishment of connections from remote nodes to the C2 node.
  • 2 The provisioning of authentication support, granting the C2 node the ability to initiate connections with other nodes in the network

Attack flow

Here's a basic outline of a C2 attack:

1. Initial compromise

Often, attackers use phishing emails or malicious downloads to breach a system. The first step in a C2 attack involves gaining initial access to a target system, often via phishing.

2. Establishing communication

Once inside, the malware establishes a covert communication channel with the C2 server. This covert communication is established with the C2 server to receive further instructions.

3. Command execution

The attacker, from their remote location, issues commands to the compromised system through the C2 server. These commands can range from data theft and reconnaissance to launching additional payloads on the victim's system.

4. Lateral movement

With control over the compromised system, the attacker can use it as a foothold to move laterally within the victim's network. They can scan for other vulnerable systems, attempt to exploit them, and potentially gain access to more valuable resources.

5. Botnet creation

The attacker can leverage multiple compromised systems under their control to create a botnet. A botnet is a network of infected computers, each referred to as a "bot," which can be coordinated to carry out various malicious activities simultaneously.

6. Shadow network formation

The botnets created by the attacker are interlinked, forming a shadow network. This network operates outside the view of the victim's network administrators, allowing the attacker to maintain control over the compromised systems while evading detection.

7. Data exfiltration and system monitoring

The compromised systems within the shadow network can be used to stealthily monitor the victim's activities, including sensitive data and communications. The attacker can exfiltrate valuable data from the compromised systems without raising suspicion.

Types of C2 techniques

1. Random architecture

  • Designed to avoid detection and disrupt the command chain of botnets.
  • Sends commands from diverse sources, like social media links, emails, etc.
  • Increases success chances by using common platforms.

2. Centralized architecture

  • Single point of control for issuing commands to infected systems.
  • Simplifies attack planning and control over compromised systems.
  • Easier to identify and shut down, as all commands come from one source.

3. Peer-to-peer architecture

  • Decentralized method where botnet nodes relay messages.
  • No central server, making it harder to locate.
  • Used as a backup in hybrid configurations if the central server is compromised.

Risks of C2 attack

  • System disruption: C2 attacks can disrupt systems, causing offline status and potential harm to vital infrastructure.
  • Data breaches: These attacks grant unauthorized access, risking the theft of sensitive firm data, including financial records and confidential information.
  • DDoS botnets: C2 server-directed hacked devices can form distributed denial of service (DDoS) botnets, launching coordinated attacks that flood targets with traffic, impeding normal use.
  • Malware attacks: After gaining network access, attackers can exploit C2 channels to distribute malware, potentially leading to data encryption and ransom demands.

Indicators of compromise (IoCs) for a C2 attack

Here are a few IoCs to look out for if you suspect that your network is undergoing a C2 attack:

  • Huge volumes of HTTP traffic: Botnets can use self-signed SSL certificates to encrypt and masquerade the outbound traffic as web traffic when they contact the C2 servers. If there is a sudden spike in the volume of HTTP traffic in your network, ensure you check the systems generating the traffic.
  • Unnecessary applications in systems: In C2 attacks, malware can install applications in systems that can increase processor usage. Check your systems for such applications, kill all processes carried out by that application, and uninstall them.
  • Anomalous DNS requests: The botnets communicate with the C2 server by sending DNS requests or beacon queries to untrusted domains. Monitoring DNS activities of systems can help to identify a C2 attack.

Detection mechanism

Effective detection of C2 attacks hinges on a strategic blend of continuous network surveillance, real-time anomaly identification, and meticulous examination of behavioral patterns.

  • 1 Rule-based log alerts: Set up custom rules within your log management system to generate alerts for specific patterns indicative of C2 activity. For instance, rules can be established to detect repeated failed login attempts, suspicious outbound connections, or known malicious IP addresses.
  • 2 Network traffic analysis: Thoroughly examine network traffic logs for anomalies, such as unusual communication patterns, large data transfers, or connections to non-standard ports. Pay attention to traffic directed at IP addresses associated with C2 servers.
  • 3 DNS monitoring: Monitor Domain Name System (DNS) logs to spot irregular domain name resolutions, rapid changes in resolved IP addresses, and the use of domain generation algorithms (DGAs) by malware. These could signify C2 communications.
  • 4 Behavioral anomaly detection: Utilize behavioral analysis techniques to identify deviations from typical patterns in user and system activity. This could involve detecting unusual login times, sudden spikes in traffic, or a higher volume of failed authentication attempts.
  • 5 Correlation and contextual analysis: Combine logs from different sources, such as firewall logs, authentication logs, and application logs, to gain a holistic view of potential C2-related activities. This approach enhances your ability to connect the dots and identify sophisticated attacks.

Enhance your security posture by leveraging the capabilities of Log360

Let our experts evaluate your security requirements and demonstrate how Log360 can help satisfy them.

  • Please enter a valid text.
  • Please enter a valid text.
  • -Select-
By clicking 'Personalized demo', you agree to processing of personal data according to the Privacy Policy.

Thank you for reaching out to us.

We will get back to you shortly.

Learn how Log360 can combat C2 attack and such stealthy attacks with a suite of security features like:

  • Network monitoring
  • Machine learning based behavior analytics
  • Incident response automation
Explore with our 30-day free trial

Detect and mitigate C2 attacks using Log360

Learn how to set up correlation rules, alerts, and incident workflows and customize them to detect and remediate C2 attacks.

  • Detection through
  • Creating an alert
    profile and workflow
  • Real-time
  • Investigation through

Detection through correlation

  1. Process creation: Event ID: 4688 indicates that a new process has been created.
  2. Event ID: 4688 logs the creation of new processes on a system. In the context of C2 attacks, it can:
    • Capture the execution of C2 malware.
    • Detect persistence mechanisms used by malware.
    • Be useful for spotting lateral movement tools or scripts.
    • Identify processes related to traffic proxying by C2 malware.
    • Help detect evasion tactics where malware masquerades as legitimate processes.
  3. While Event ID: 4688 is relevant for detecting C2 activities, it's just one of many indicators and should be combined with other logs and signals for comprehensive threat detection.
  • Detection through correlation1
  • Detection through correlation2
  • Detection through correlation3

Creating an alert profile and workflow

Log360 offers a powerful Correlation Alert Profile feature that enhances your cybersecurity capabilities by identifying potential C2 activities. This is achieved by configuring a specific correlation rule, such as the DNS Tunnel Technique from the MuddyWater rule set. Once configured, Log360 can automatically trigger a workflow with various response actions, such as disabling a computer, logging off a user, or terminating a suspicious process, whenever it detects suspicious C2 activity based on the defined rule.

  • Creating an alert profile and workflow1
  • Creating an alert profile and workflow2

Real-time alerts

Log360 equips you with real-time alerting capabilities that play a pivotal role in proactively identifying and responding to C2 activities. These alerts are configured to detect specific C2 patterns, such as the DNS Tunnel Technique from MuddyWater. When triggered, these alerts provide you with immediate notifications and set up custom workflows when suspicious C2 patterns are identified. These alerts include critical details such as device names, user accounts, and domains, ensuring you're well-equipped to respond swiftly to potential threats.

  • Real-time alerts1
  • Real-time alerts2
  • Real-time alerts3

Investigation through reports

Log360, utilizing Mitre ATT&CK and correlation rules, strengthens C2 detection. By selecting specific C2 threat indicators like the DNS Tunnel Technique from MuddyWater, Log360 offers powerful reporting features for customizing, scheduling, and gaining insights into network security and compliance. Reports can be pinned, integrated, filtered, and set for automated email delivery, supporting a secure IT environment and improved C2 threat response.

  • Investigation through reports

Implement defensive strategies and incident response measures using the advanced security features of Log360.

Download now

Get the latest content delivered
right to your inbox!


Cyber Security - Knowledge Base


  Zoho Corporation Pvt. Ltd. All rights reserved.