It can use dedicated servers, relays, peer-to-peer networks, compromised infrastructure, or legitimate online services. C2 is a role and behavior, not one protocol, address, tool, or generic outbound connection.
An implant may contact infrastructure periodically, keep a session open, retrieve tasks through a shared location, or receive one-way instructions. Traffic can use common application protocols, encryption, proxies, and changing destinations to resemble expected activity. Investigation therefore combines communication patterns with process, identity, configuration, and task evidence.
Key points
Operational functionsC2 can deliver commands and configuration, transfer additional components, coordinate many bots, change timing or infrastructure, and receive execution results or collected information.
ArchitectureMap controllers, redirects, proxies, compromised relays, dead-drop locations, peer relationships, fallback paths, and the systems that resolve or host them without assuming one central server.
Detection and scopingCorrelate unusual timing, destinations, protocol behavior, process ancestry, domain or certificate history, endpoint events, and known infrastructure; validate whether the communication has an approved owner and purpose.
Important limitationBeacon-like timing, encryption, dynamic domains, or traffic to a cloud service can all be legitimate. Blocking one destination may reveal a fallback or interrupt evidence without removing the implant, stolen identity, persistence, or other affected systems.