# What is Command and Control (C2)?

> Command and control (C2) is the attacker communication and coordination function that lets compromised systems, accounts, or services receive instructions and return status, results, or data.

- Canonical URL: https://yellowcube.eu/glossary/command-and-control/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It can use dedicated servers, relays, peer-to-peer networks, compromised infrastructure, or legitimate online services. C2 is a role and behavior, not one protocol, address, tool, or generic outbound connection.

An implant may contact infrastructure periodically, keep a session open, retrieve tasks through a shared location, or receive one-way instructions. Traffic can use common application protocols, encryption, proxies, and changing destinations to resemble expected activity. Investigation therefore combines communication patterns with process, identity, configuration, and task evidence.

### Key points

- **Operational functions:** C2 can deliver commands and configuration, transfer additional components, coordinate many bots, change timing or infrastructure, and receive execution results or collected information.
- **Architecture:** Map controllers, redirects, proxies, compromised relays, dead-drop locations, peer relationships, fallback paths, and the systems that resolve or host them without assuming one central server.
- **Detection and scoping:** Correlate unusual timing, destinations, protocol behavior, process ancestry, domain or certificate history, endpoint events, and known infrastructure; validate whether the communication has an approved owner and purpose.
- **Important limitation:** Beacon-like timing, encryption, dynamic domains, or traffic to a cloud service can all be legitimate. Blocking one destination may reveal a fallback or interrupt evidence without removing the implant, stolen identity, persistence, or other affected systems.

### Related terms

[Botnet](<https://yellowcube.eu/glossary/botnet/>) · [Remote access trojan (RAT)](<https://yellowcube.eu/glossary/remote-access-trojan/>) · [Network detection and response (NDR)](<https://yellowcube.eu/glossary/network-detection-and-response/>) · [Indicator of compromise (IoC)](<https://yellowcube.eu/glossary/indicator-of-compromise/>) · [Fast-flux network](<https://yellowcube.eu/glossary/fast-flux-network/>)

### Sources

[MITRE ATT&CK TA0011: Command and Control](https://attack.mitre.org/tactics/TA0011/) · [MITRE ATT&CK T1102: Web Service](https://attack.mitre.org/techniques/T1102/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.