Command-and-Control Traffic

Expanded Definition

Command-and-control traffic is not the malware itself. It is the communication channel that allows an attacker to issue instructions, receive status, and move laterally after an initial compromise. In modern incident response, the term often applies to outbound DNS, HTTPS, WebSocket, or other application-layer traffic that looks ordinary until its destination, timing, or session behavior is examined. Definitions vary across vendors on how much protocol detail must be present before a flow is treated as C2, but the security meaning is consistent: the traffic supports active attacker control rather than legitimate business communications.

For NHI Management Group, the most useful way to think about C2 is as an observable signal in a broader kill chain, not a standalone event. Detection teams typically correlate endpoint, network, cloud, and identity telemetry to determine whether the process generating the traffic is expected, whether the destination is trusted, and whether the connection pattern matches known beaconing or tasking behavior. The NIST Cybersecurity Framework 2.0 helps anchor this work in continuous monitoring and response. The most common misapplication is treating any unusual outbound connection as C2, which occurs when teams ignore process lineage, asset context, and approved software update channels.

Examples and Use Cases

Implementing command-and-control detection rigorously often introduces triage noise, requiring organisations to weigh fast containment against the risk of blocking legitimate cloud, CDN, or remote administration traffic.

• A compromised server makes periodic HTTPS requests to a rare domain at fixed intervals, a pattern that may indicate beaconing rather than ordinary web browsing.
• A malicious script inside a CI pipeline reaches out to an external endpoint to fetch the next stage of payloads, then waits for instructions before executing.
• A non-human identity used by an automation workload begins opening outbound sessions to an unapproved IP range, which can reveal token theft or tool abuse.
• DNS queries contain encoded data in subdomains, suggesting a covert control channel even when the payload is not visible at the firewall.
• Security analysts compare the traffic against guidance from MITRE ATT&CK to determine whether the observed pattern matches known adversary infrastructure or behavior.

Why It Matters for Security Teams

C2 traffic matters because it is often the point at which a compromise becomes operational. Once an attacker can reliably communicate with an endpoint, the impact can expand from a single foothold to credential theft, data staging, exfiltration, or ransomware deployment. For security teams, the challenge is not simply blocking bad destinations, but distinguishing malicious control channels from sanctioned automation, software updates, and remote support tools. That is why telemetry from CISA guidance on command and control and network-aware frameworks such as the CISA ecosystem is often paired with endpoint lineage, identity validation, and egress control.

The identity connection is especially important where attackers abuse service accounts, API keys, or other NHIs to blend into normal workload traffic. If those identities have broad outbound reach, C2 can hide inside approved automation paths until an investigation forces the issue. Organisations typically encounter the operational cost only after an endpoint is already beaconing or a workload has started exfiltrating data, at which point command-and-control traffic becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What do security teams get wrong about encrypted command and control traffic?
• When does cloud service access become a command-and-control risk?
• Who should own AI governance when existing security tools already cover traffic control?
• When should organisations centralise control for AI traffic?