# What is command and control (C2) as an ATT&CK tactic?

Command and control is the tactic attackers use to talk to the systems they have compromised: to send commands, receive results and deliver more tools. Techniques include regular check-ins over web protocols, encrypted channels, legitimate cloud services or messaging platforms used as relays, tunnelling through DNS or other protocols, non-standard ports, and proxies that hide the real server. Because the channel has to exist for the attacker to act, it is one of the most reliable things to detect, even when the content is encrypted: timing, destination and rhythm give it away. Blocking known bad destinations helps but does not catch new ones. NetSenX flags beaconing on every plan and DNS tunnelling, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-command-and-control-in-mitre-attack

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is the Impact tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-impact-tactic-in-mitre-attack)
- [What is the cyber kill chain, and how does it relate to MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-cyber-kill-chain)
- [How can a small team use MITRE ATT&CK to find gaps in its detection?](https://netsenx.com/en/faq/how-to-use-mitre-attack-to-find-gaps-in-detection)
- [What happens after an attacker gets into the network?](https://netsenx.com/en/faq/what-happens-after-an-attacker-gets-in)
- [Can antivirus or EDR alone catch lateral movement?](https://netsenx.com/en/faq/can-antivirus-or-edr-alone-catch-lateral-movement)