← All seven stages

Stage 6 / 7 · Coordinate the operation

Command and Control

Channels through which an operator or infrastructure communicates with compromised systems.

38 readings · Guides can appear in more than one stage.

Understanding Command and Control

Command and Control, often shortened to C2, is the communication that lets an adversary direct or coordinate activity on compromised systems. The channel may deliver instructions, return results, or obtain additional components. It can use familiar protocols and legitimate services, so the protocol name alone does not establish malicious intent.

Typical activities

Example: A process repeatedly contacts an unfamiliar destination and receives responses before launching commands. Timing, destination history, process identity, and the resulting actions together support a C2 hypothesis.

A domain in a binary, periodic traffic, encryption, or use of port 443 is not sufficient proof of C2. Some payloads operate autonomously after staging and do not need a continuing command channel. Data transferred over C2 may also serve an objective such as exfiltration.

Defender’s question: Who is communicating, what changes after the communication, and what corroborates operator control?

Guides and articles by Andrey 38

Authoritative external resources

Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:

Defensive focus: Combine DNS, HTTP/TLS, flow metadata, and endpoint context. A suspicious connection alone does not establish C2.

Methods across stages

Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.

Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.