Command-and-control (C2) traffic is communication an attacker uses to direct or receive information from systems they have compromised. It can travel through familiar protocols such as HTTP, HTTPS, or DNS, so a protocol name—or encryption—does not by itself make a connection benign. The useful question is whether the traffic’s behavior fits the protocol and the organization’s normal network activity.
What command-and-control traffic means
C2 describes the purpose of a communication: an adversary uses it to control compromised systems, exchange instructions, or otherwise communicate with them. It is not a synonym for every suspicious outbound connection. A connection needs to be understood in context before it can be classified as malicious.
As an Amazon Associate I earn from qualifying purchases.
Attackers may choose a familiar application protocol because ordinary networks already use it. MITRE ATT&CK notes that adversaries commonly try to mimic expected traffic to avoid detection. That can make C2 less conspicuous, but it does not make the traffic indistinguishable from legitimate use.
Recommended Free Tools
How C2 can blend into ordinary protocols
Using an application protocol as the carrier
A carrier is the protocol used to transport the communication. C2 may use web protocols, DNS, file-transfer protocols, or other application services. CISA’s APT40 advisory describes examples that include web and file-transfer protocols, proxies, encrypted channels, domain fronting, and protocol tunneling. Those are techniques observed in that advisory, not a checklist of methods used by every adversary.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Seeing HTTP, HTTPS, or DNS in a connection record tells an analyst what protocol appears to be in use; it does not establish the traffic’s purpose. Legitimate applications and malicious operators can both use familiar protocols.
Encapsulating one protocol inside another
Protocol tunneling means explicitly carrying one protocol inside another. The outer protocol can make the communication resemble allowed traffic, and it may add encryption. For example, DNS over HTTPS (DoH) carries DNS queries inside encrypted HTTPS packets. The outer connection is HTTPS, while the encapsulated data is DNS.
MITRE ATT&CK describes both SSH tunneling, which can forward arbitrary data through an encrypted SSH tunnel, and DoH used to conceal DNS queries associated with C2 infrastructure. A tunnel is a particular encapsulation method; not every use of a familiar protocol is a tunnel.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
Using a proxy or relay
Routing is separate from the choice of carrier or tunnel. A system may communicate directly with an infrastructure endpoint, or the connection may pass through a proxy or relay. Proxy use can obscure the ultimate destination from a simple network view, but a proxy is not itself proof of C2: organizations and legitimate services use proxies too.
Choosing a port independently of the protocol
A protocol and a port are distinct properties. HTTP does not imply that traffic uses port 80, just as a port number alone does not establish which application protocol is present. CISA’s mapping guide uses HTTP-based C2 over port 8088 as an example of recording both protocol and non-standard port. Analysts should not infer the port from the protocol label.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to investigate suspected C2
CISA recommends monitoring protocol traffic and inspecting packets for departures from expected standards and flows, including extraneous packets, anomalous patterns, and unusual syntax or structure. Its communications-infrastructure guidance also recommends establishing a baseline of normal network behavior and alerting on abnormal activity. These are ways to identify leads for investigation, not a universal formula that proves C2.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
- Establish what is normal. Build a baseline for the relevant network, systems, and services. A pattern that is unusual in one environment may be routine in another.
- Check protocol behavior. Compare observed traffic with the protocol’s expected flows and structure. Look for packets that do not fit an established flow, unusual syntax, or gratuitous or anomalous patterns.
- Put the connection in context. Consider whether the destination, timing, volume, and protocol use make sense for the host’s role. These are practical investigation dimensions, not fixed thresholds or a standalone official test.
- Correlate with other evidence. Review network observations alongside endpoint activity and incident context. A single network signal is not enough to establish that a system is compromised.
What familiar protocols and encryption do—and do not—tell you
Encryption can protect legitimate traffic and can also conceal the contents of malicious communications. When payloads are encrypted, an observer may have less visibility into their contents, making metadata, flow behavior, endpoint evidence, and a local baseline more important. Encryption alone is neither a verdict of safety nor evidence of wrongdoing.
Likewise, unusual traffic is an investigative lead, not proof. Legitimate software may use uncommon services or create patterns that differ from a broad network baseline. The reviewed CISA guidance does not prescribe a universal detection threshold or quantify false-positive rates, so defenders should set expectations for their own environment rather than apply an unsupported fixed rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
