📖 What is Command and Control (C2)?
Command and Control (C2) refers to the infrastructure used by an attacker to send commands to systems compromised by malware. This channel allows the attacker to maintain persistence, exfiltrate data, and deploy additional payloads across the target network remotely.
"Be aware of 'beaconing,' where the compromised host checks in with the C2 server at regular intervals to avoid detection by traffic analysis."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Command and Control (C2)?
- ▸ Beaconing involves compromised hosts checking in with the C2 server at intervals, often using jitter to randomize timing and evade pattern-based detection.
- ▸ C2 channels often utilize common protocols like HTTP, HTTPS, and DNS to blend in with legitimate traffic and bypass outbound firewall restrictions.
- ▸ Infrastructure obfuscation techniques, such as using redirectors or domain fronting, hide the primary C2 server's identity to prevent it from being blocked.
- ▸ Staged payloads involve a small initial dropper that establishes the C2 connection before downloading the full-featured agent or additional post-exploitation tools.
- ▸ Persistence ensures the C2 agent survives system reboots by modifying registry keys, creating scheduled tasks, or installing malicious system services.
🎯 How does Command and Control (C2) appear on the PT0-002 Exam?
You may be asked to identify a C2 channel by analyzing network logs that show periodic, small HTTP requests to an external domain, where you must recognize the behavior as beaconing.
A scenario might describe a target environment with a strict outbound firewall that blocks most ports; you will need to select a covert channel, such as DNS tunneling, to maintain communication.
Expect questions about configuring C2 frameworks to avoid detection, specifically focusing on the implementation of jitter to break the predictability of beaconing intervals to evade an Intrusion Detection System.
❓ Frequently Asked Questions
What is the difference between a C2 server and a listener?
The C2 server is the central management hub where the attacker controls the operation. The listener is the specific port and protocol configuration on that server waiting for incoming connections.
How does domain fronting help an attacker hide their C2 traffic?
It leverages high-reputation CDN domains to mask the true destination. The initial request goes to a legitimate service, but the internal HTTP header redirects traffic to the attacker's server.
Why is jitter critical when configuring C2 beacons for a stealthy operation?
Fixed-interval beaconing creates a predictable heartbeat pattern that is easily flagged by traffic analysis tools. Jitter adds random time variations to make the traffic look like natural human behavior.