liveBook · Manning

Command-and-control server

As explained in Cyber Threat Hunting

A command-and-control server is an adversary-controlled system that communicates with and directs compromised machines remotely.

A command-and-control (C2) server is an adversary-controlled system used to direct and manage compromised machines remotely. One hunting signal is beaconing: an internal host repeatedly connects to an external destination, often at regular intervals. Regular traffic alone is not proof; antivirus, email, and patching clients may also connect on schedules, and some malware varies its timing. section 6.1.1

Investigate candidate C2 activity by grouping timestamped network connections by source IP, destination IP, and destination port; calculate the time between successive connections; then prioritize frequent groups with low variation in those intervals. Network firewalls and other connection telemetry must provide timestamps plus source address, destination address, and destination port. section 6.1.1 section 6.1.5

Treat periodicity as a lead, then add context before reaching a conclusion:

  • Separate ordinary recurring services from unfamiliar public destinations; known domains, services, certificates, and broad use across hosts can explain regular traffic. section 6.1.1 section 6.1.5
  • Inspect application and HTTP details, including URI paths, methods, status codes, and application classification. section 6.1.5
  • Check external reputation and community reporting, then identify the local process responsible for the connection. section 6.1.5

A suspicious external destination

Host 10.0.0.4 repeatedly contacted 34.125.188.180 on port 80 at intervals concentrated around one and 60 seconds. The destination lacked associated domains or known services, requests used /cm and /submit.php, and reputation research linked the address to a Cobalt Strike server. An osquery lookup then associated the remote connection with powershell.exe. section 6.1.5

Listing 6.43 Listing processes connecting to 34.125.188.180
SELECT DISTINCT
  pos.pid,
  p.name,
  pos.local_address,
  pos.local_port,
  pos.remote_address,
  pos.remote_port
FROM
  processes p
  JOIN process_open_sockets pos USING (pid)
WHERE
  pos.remote_address like "%34.125.188.180%"            #1

Use the osquery query to map a suspicious remote address back to a process, PID, and local and remote socket details. section 6.1.5

How Cyber Threat Hunting covers it

How deep it goes
Works through connection grouping, interval statistics, HTTP inspection, reputation checks, and host-process attribution; it limits timing analysis to regular beacons.
Examples
Demonstrates 10.0.0.4 contacting 34.125.188.180 through periodic requests to /cm and /submit.php, then traces the connection to powershell.exe.
What it assumes
Uses timestamped network connection records and introduces the required fields and recurring-connection pattern from zero.
What you can do after
Diagnose/debug with it by prioritizing periodic outbound connections and linking a suspicious destination to its initiating process.
How it connects
Connects command-and-control servers to beaconing, network connection telemetry, standard deviation, HTTP, VirusTotal, osquery, PowerShell, and Cobalt Strike.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.