WebSocket Command and Control

Expanded Definition

WebSocket command and control is a persistent, bidirectional channel that lets malware receive tasking and return results in real time. Unlike one-off callbacks or simple beaconing, a WebSocket session can remain open long enough to support interactive control, staged payload delivery, and continuous data transfer while blending into ordinary application traffic. In NHI and agentic environments, the distinction matters because the channel may be carried by legitimate browser or service infrastructure, not just obvious malicious tooling. Guidance varies across vendors on whether this is classified by transport, by attacker behavior, or by the payload activity observed over the socket, so defenders should anchor the term to observed command exchange rather than to WebSocket use alone. The RFC 6455 WebSocket Protocol defines the underlying protocol, but it does not define malicious command and control use. NHI Management Group treats the term as an abuse pattern that becomes especially important when service identities, tokens, or embedded secrets are used to keep the session alive. The most common misapplication is calling any WebSocket connection "C2" when the condition is merely a legitimate real-time application session without attacker tasking.

Examples and Use Cases

Implementing detection for WebSocket command and control rigorously often introduces inspection and telemetry overhead, requiring organisations to weigh real-time visibility against application performance and privacy constraints.

• A compromised API token opens a WebSocket session that receives commands to enumerate cloud resources and exfiltrate results over the same channel.
• A malicious browser extension uses a long-lived socket to relay keystrokes and environment data while impersonating normal collaborative app traffic.
• An infected CI/CD runner maintains a socket to a remote operator for staged execution, token harvesting, and pivot instructions.
• A living-off-the-land payload uses WebSocket-based tasking so outbound traffic resembles routine app connectivity, complicating perimeter-only controls.

For defenders, the practical signal is not the protocol alone but the combination of persistence, irregular message cadence, and command-like payloads. The ENISA Threat Landscape is useful for situating this pattern within broader web and cloud attack techniques, while Ultimate Guide to NHIs — Standards provides the governance lens for identities that may be abused to sustain the channel.

Why It Matters in NHI Security

WebSocket command and control matters because it turns compromised NHIs into interactive footholds that are harder to distinguish from normal service behavior. When service accounts, API keys, or agent credentials are overprivileged, an attacker can preserve access, issue commands, and move laterally without repeatedly reauthenticating. That makes identity hygiene, secret rotation, and session telemetry core controls rather than optional hardening. NHI Management Group reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is why persistent channels tied to those identities deserve special scrutiny. The same guide also notes that 97% of NHIs carry excessive privileges, a condition that can convert a single socket into broad operational reach. Once a compromise is detected, investigators often need to reconstruct not just what data moved, but which identity sustained the session and what authority it held. Organisations typically encounter the operational impact only after an anomalous live session is discovered, at which point WebSocket command and control becomes unavoidable to address.

Related resources from NHI Mgmt Group

• When does cloud service access become a command-and-control risk?
• Command And Control Channel
• WebSocket Command Injection
• Command-Level Control