// ATTACK CONTROL
C2 (command and control): how an attacker controls access in a network
C2, short for command and control, is the communication channel an attacker uses to control the access they gained inside a network: it carries commands in and results out. MITRE ATT&CK lists it as the Command and Control tactic. It appears only after the attacker gets into the network, so it belongs to a late phase of an attack. For a defender it is one of the last chances to catch the attack before it reaches its goal.
// 01
What is C2 for in an attack?
C2 serves an attacker for three things: keeping the access they gained, sending commands in, and taking results out, stolen data for instance. Without that channel they would control one computer and get no further.
In the course of an attack it comes only after the breach. First the attacker gets in and widens the access; only then do they need a channel to run the whole thing remotely. MITRE ATT&CK lists it as the Command and Control tactic (TA0011), one of the phases it breaks an attacker’s progress into; where C2 sits in the chain of tactics is shown by the entry on ATT&CK. What C2 usually precedes, movement through the domain that the attacker directs through it, is the subject of a separate article.
// 02
How is C2 traffic spotted?
C2 traffic is recognized by its communication patterns, not by its content. The content of the channel tends to be encrypted, so it can’t be read; what stands out is how the traffic looks: where it goes and how regularly it calls home. Whether you would catch such communication at your company can be verified only in live operation, by a red team operation in covert mode.
Related pages
Updated September 5, 2026.
// NEXT STEP
Find out whether you would catch such communication in your network
Tell us what you want tested. We’ll get back to you and schedule a call to pin down scope, timing, and price.