ConceptsC2 Communication Detection

C2 Communication Detection

Detections that identify command-and-control traffic, the channel a compromised host uses to receive attacker instructions, by spotting patterns like regular beaconing, suspicious destinations, or anomalous protocols.

Glossary definition

7 direct links5 lessons

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Beacons

The foundation C2 Communication Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

BeaconsStart here

The periodic check-ins a compromised host makes to an attacker's command-and-control server to receive instructions. Their regular, often-disguised pattern is a key signal defenders hunt for to find hidden footholds.

lesson

Relatedsorted by lesson coverage

Benign True Positive

lessons

Detection Testing

lessons

Coverage Validation

lessons

MITRE ATT&CK Framework

lessons

Campaign Tracking

lessons

C2 Hunts

lesson

Related Lessons

5 lessons cover this concept

Build Endpoint Behavior Analytics

SOC Analyst

Correlate Identity, Remote Access, and Network Behavior

SOC Analyst

Use ATT&CK Without Overclaiming Coverage

SOC Analyst

From Hypothesis to Telemetry Contract

SOC Analyst

Engineer Rules, Tuning, and Response Contracts

SOC Analyst